<?xml version="1.0" encoding="ascii"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
          "DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
  <title>Forensie</title>
  <link rel="stylesheet" href="epydoc.css" type="text/css" />
  <script type="text/javascript" src="epydoc.js"></script>
</head>

<body bgcolor="white" text="black" link="blue" vlink="#204080"
      alink="#204080">
<!-- ==================== NAVIGATION BAR ==================== -->
<table class="navbar" border="0" width="100%" cellpadding="0"
       bgcolor="#a0c0ff" cellspacing="0">
  <tr valign="middle">

  <!-- Tree link -->
      <th>&nbsp;&nbsp;&nbsp;<a
        href="module-tree.html">Trees</a>&nbsp;&nbsp;&nbsp;</th>

  <!-- Index link -->
      <th>&nbsp;&nbsp;&nbsp;<a
        href="identifier-index.html">Indices</a>&nbsp;&nbsp;&nbsp;</th>

  <!-- Help link -->
      <th>&nbsp;&nbsp;&nbsp;<a
        href="help.html">Help</a>&nbsp;&nbsp;&nbsp;</th>

  <!-- Project homepage -->
      <th class="navbar" align="right" width="100%">
        <table border="0" cellpadding="0" cellspacing="0">
          <tr><th class="navbar" align="center"
            ><a class="navbar" target="_top" href="http://code.google.com/p/forensie/">Forensie</a></th>
          </tr></table></th>
  </tr>
</table>
<table width="100%" cellpadding="0" cellspacing="0">
  <tr valign="top">
    <td width="100%">
      <span class="breadcrumbs">
        Module&nbsp;Forensie
      </span>
    </td>
    <td>
      <table cellpadding="0" cellspacing="0">
        <!-- hide/show private -->
        <tr><td align="right"><span class="options">[<a href="javascript:void(0);" class="privatelink"
    onclick="toggle_private();">hide&nbsp;private</a>]</span></td></tr>
        <tr><td align="right"><span class="options"
            >[<a href="frames.html" target="_top">frames</a
            >]&nbsp;|&nbsp;<a href="Forensie-pysrc.html"
            target="_top">no&nbsp;frames</a>]</span></td></tr>
      </table>
    </td>
  </tr>
</table>
<h1 class="epydoc">Source Code for <a href="Forensie-module.html">Module Forensie</a></h1>
<pre class="py-src">
<a name="L1"></a><tt class="py-lineno">  1</tt>  <tt class="py-line"><tt class="py-comment"># Imports</tt> </tt>
<a name="L2"></a><tt class="py-lineno">  2</tt>  <tt class="py-line"><tt class="py-keyword">from</tt> <tt class="py-name">re</tt> <tt class="py-keyword">import</tt> <tt class="py-name">sub</tt><tt class="py-op">,</tt> <tt class="py-name">findall</tt> </tt>
<a name="L3"></a><tt class="py-lineno">  3</tt>  <tt class="py-line"><tt class="py-keyword">import</tt> <tt class="py-name">string</tt> </tt>
<a name="L4"></a><tt class="py-lineno">  4</tt>  <tt class="py-line"> </tt>
<a name="L5"></a><tt class="py-lineno">  5</tt>  <tt class="py-line"><tt class="py-comment"># Globals</tt> </tt>
<a name="L6"></a><tt class="py-lineno">  6</tt>  <tt class="py-line"><tt id="link-0" class="py-name" targets="Variable Forensie.F_DEBUG=Forensie-module.html#F_DEBUG"><a title="Forensie.F_DEBUG" class="py-name" href="#" onclick="return doclink('link-0', 'F_DEBUG', 'link-0');">F_DEBUG</a></tt> <tt class="py-op">=</tt> <tt class="py-name">False</tt> </tt>
<a name="L7"></a><tt class="py-lineno">  7</tt>  <tt class="py-line"><tt id="link-1" class="py-name" targets="Variable Forensie.HEXBIN_TRANS=Forensie-module.html#HEXBIN_TRANS"><a title="Forensie.HEXBIN_TRANS" class="py-name" href="#" onclick="return doclink('link-1', 'HEXBIN_TRANS', 'link-1');">HEXBIN_TRANS</a></tt> <tt class="py-op">=</tt> <tt class="py-op">{</tt><tt class="py-string">'0'</tt><tt class="py-op">:</tt> <tt class="py-string">'0000'</tt><tt class="py-op">,</tt> <tt class="py-string">'1'</tt><tt class="py-op">:</tt> <tt class="py-string">'0001'</tt><tt class="py-op">,</tt> <tt class="py-string">'2'</tt><tt class="py-op">:</tt> <tt class="py-string">'0010'</tt><tt class="py-op">,</tt> <tt class="py-string">'3'</tt><tt class="py-op">:</tt> <tt class="py-string">'0011'</tt><tt class="py-op">,</tt> <tt class="py-string">'4'</tt><tt class="py-op">:</tt> <tt class="py-string">'0100'</tt><tt class="py-op">,</tt> <tt class="py-string">'5'</tt><tt class="py-op">:</tt> <tt class="py-string">'0101'</tt><tt class="py-op">,</tt> <tt class="py-string">'6'</tt><tt class="py-op">:</tt> <tt class="py-string">'0110'</tt><tt class="py-op">,</tt> <tt class="py-string">'7'</tt><tt class="py-op">:</tt> <tt class="py-string">'0111'</tt><tt class="py-op">,</tt> <tt class="py-string">'8'</tt><tt class="py-op">:</tt> <tt class="py-string">'1000'</tt><tt class="py-op">,</tt> <tt class="py-string">'9'</tt><tt class="py-op">:</tt> <tt class="py-string">'1001'</tt><tt class="py-op">,</tt> <tt class="py-string">'a'</tt><tt class="py-op">:</tt> <tt class="py-string">'1010'</tt><tt class="py-op">,</tt> <tt class="py-string">'b'</tt><tt class="py-op">:</tt> <tt class="py-string">'1011'</tt><tt class="py-op">,</tt> <tt class="py-string">'c'</tt><tt class="py-op">:</tt> <tt class="py-string">'1100'</tt><tt class="py-op">,</tt> <tt class="py-string">'d'</tt><tt class="py-op">:</tt> <tt class="py-string">'1101'</tt><tt class="py-op">,</tt> <tt class="py-string">'e'</tt><tt class="py-op">:</tt> <tt class="py-string">'1110'</tt><tt class="py-op">,</tt> <tt class="py-string">'f'</tt><tt class="py-op">:</tt> <tt class="py-string">'1111'</tt><tt class="py-op">,</tt> <tt class="py-string">'A'</tt><tt class="py-op">:</tt> <tt class="py-string">'1010'</tt><tt class="py-op">,</tt> <tt class="py-string">'B'</tt><tt class="py-op">:</tt> <tt class="py-string">'1011'</tt><tt class="py-op">,</tt> <tt class="py-string">'C'</tt><tt class="py-op">:</tt> <tt class="py-string">'1100'</tt><tt class="py-op">,</tt> <tt class="py-string">'D'</tt><tt class="py-op">:</tt> <tt class="py-string">'1101'</tt><tt class="py-op">,</tt> <tt class="py-string">'E'</tt><tt class="py-op">:</tt> <tt class="py-string">'1110'</tt><tt class="py-op">,</tt> <tt class="py-string">'F'</tt><tt class="py-op">:</tt> <tt class="py-string">'1111'</tt><tt class="py-op">}</tt> </tt>
<a name="L8"></a><tt class="py-lineno">  8</tt>  <tt class="py-line"> </tt>
<a name="Forensie"></a><div id="Forensie-def"><a name="L9"></a><tt class="py-lineno">  9</tt> <a class="py-toggle" href="#" id="Forensie-toggle" onclick="return toggle('Forensie');">-</a><tt class="py-line"><tt class="py-keyword">class</tt> <a class="py-def-name" href="Forensie.Forensie-class.html">Forensie</a><tt class="py-op">:</tt> </tt>
</div><div id="Forensie-collapsed" style="display:none;" pad="+++" indent="++++"></div><div id="Forensie-expanded"><a name="L10"></a><tt class="py-lineno"> 10</tt>  <tt class="py-line">        <tt class="py-comment"># Custom Exceptions</tt> </tt>
<a name="Forensie.FormatError"></a><div id="Forensie.FormatError-def"><a name="L11"></a><tt class="py-lineno"> 11</tt> <a class="py-toggle" href="#" id="Forensie.FormatError-toggle" onclick="return toggle('Forensie.FormatError');">-</a><tt class="py-line">        <tt class="py-keyword">class</tt> <a class="py-def-name" href="Forensie.Forensie.FormatError-class.html">FormatError</a><tt class="py-op">(</tt><tt class="py-base-class">Exception</tt><tt class="py-op">)</tt><tt class="py-op">:</tt> </tt>
</div><div id="Forensie.FormatError-collapsed" style="display:none;" pad="+++" indent="++++++++++++"></div><div id="Forensie.FormatError-expanded"><a name="L12"></a><tt class="py-lineno"> 12</tt>  <tt class="py-line">                <tt class="py-keyword">pass</tt> </tt>
</div><a name="L13"></a><tt class="py-lineno"> 13</tt>  <tt class="py-line">         </tt>
<a name="L14"></a><tt class="py-lineno"> 14</tt>  <tt class="py-line">        <tt class="py-comment"># Class Methods</tt> </tt>
<a name="Forensie.__init__"></a><div id="Forensie.__init__-def"><a name="L15"></a><tt class="py-lineno"> 15</tt> <a class="py-toggle" href="#" id="Forensie.__init__-toggle" onclick="return toggle('Forensie.__init__');">-</a><tt class="py-line">        <tt class="py-keyword">def</tt> <a class="py-def-name" href="Forensie.Forensie-class.html#__init__">__init__</a><tt class="py-op">(</tt><tt class="py-param">self</tt><tt class="py-op">,</tt> <tt class="py-param">instr</tt><tt class="py-op">)</tt><tt class="py-op">:</tt> </tt>
</div><div id="Forensie.__init__-collapsed" style="display:none;" pad="+++" indent="++++++++++++"></div><div id="Forensie.__init__-expanded"><a name="L16"></a><tt class="py-lineno"> 16</tt>  <tt class="py-line">                <tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">origStr</tt> <tt class="py-op">=</tt> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">inputStr</tt> <tt class="py-op">=</tt> <tt class="py-name">instr</tt> </tt>
<a name="L17"></a><tt class="py-lineno"> 17</tt>  <tt class="py-line">                <tt class="py-name">self</tt><tt class="py-op">.</tt><tt id="link-2" class="py-name" targets="Method Forensie.Forensie.RemoveDelimiters()=Forensie.Forensie-class.html#RemoveDelimiters"><a title="Forensie.Forensie.RemoveDelimiters" class="py-name" href="#" onclick="return doclink('link-2', 'RemoveDelimiters', 'link-2');">RemoveDelimiters</a></tt><tt class="py-op">(</tt><tt class="py-op">)</tt> </tt>
<a name="L18"></a><tt class="py-lineno"> 18</tt>  <tt class="py-line">                <tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">endian</tt> <tt class="py-op">=</tt> <tt class="py-string">'little'</tt> </tt>
<a name="L19"></a><tt class="py-lineno"> 19</tt>  <tt class="py-line">                <tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">PType</tt> <tt class="py-op">=</tt> <tt class="py-op">{</tt><tt class="py-string">'BE'</tt><tt class="py-op">:</tt> <tt class="py-string">'Solaris 8 boot partition'</tt><tt class="py-op">,</tt> <tt class="py-string">'BF'</tt><tt class="py-op">:</tt> <tt class="py-string">'New Solaris x86 partition'</tt><tt class="py-op">,</tt> <tt class="py-string">'BB'</tt><tt class="py-op">:</tt> <tt class="py-string">'Boot Wizard hidden'</tt><tt class="py-op">,</tt> <tt class="py-string">'BC'</tt><tt class="py-op">:</tt> <tt class="py-string">'Acronis backup partition'</tt><tt class="py-op">,</tt> <tt class="py-string">'16'</tt><tt class="py-op">:</tt> <tt class="py-string">'Hidden DOS 16-bit FAT &gt;=32M'</tt><tt class="py-op">,</tt> <tt class="py-string">'4A'</tt><tt class="py-op">:</tt> <tt class="py-string">"Mark Aitchison's ALFS/THIN lightweight filesystem for DOS or AdaOS Aquila (Withdrawn)"</tt><tt class="py-op">,</tt> <tt class="py-string">'5C'</tt><tt class="py-op">:</tt> <tt class="py-string">'Priam EDisk'</tt><tt class="py-op">,</tt> <tt class="py-string">'24'</tt><tt class="py-op">:</tt> <tt class="py-string">'NEC DOS 3.x'</tt><tt class="py-op">,</tt> <tt class="py-string">'26'</tt><tt class="py-op">:</tt> <tt class="py-string">'Reserved'</tt><tt class="py-op">,</tt> <tt class="py-string">'27'</tt><tt class="py-op">:</tt> <tt class="py-string">'PQservice or Windows RE hidden partition or MirOS partition or RouterBOOT kernel partition'</tt><tt class="py-op">,</tt> <tt class="py-string">'20'</tt><tt class="py-op">:</tt> <tt class="py-string">'Unused'</tt><tt class="py-op">,</tt> <tt class="py-string">'21'</tt><tt class="py-op">:</tt> <tt class="py-string">'Reserved or Unused'</tt><tt class="py-op">,</tt> <tt class="py-string">'22'</tt><tt class="py-op">:</tt> <tt class="py-string">'Unused'</tt><tt class="py-op">,</tt> <tt class="py-string">'23'</tt><tt class="py-op">:</tt> <tt class="py-string">'Reserved'</tt><tt class="py-op">,</tt> <tt class="py-string">'1B'</tt><tt class="py-op">:</tt> <tt class="py-string">'Hidden WIN95 OSR2 FAT32'</tt><tt class="py-op">,</tt> <tt class="py-string">'11'</tt><tt class="py-op">:</tt> <tt class="py-string">'Hidden DOS 12-bit FAT or Leading Edge DOS 3.x logically sectored FAT'</tt><tt class="py-op">,</tt> <tt class="py-string">'10'</tt><tt class="py-op">:</tt> <tt class="py-string">'OPUS (?)'</tt><tt class="py-op">,</tt> <tt class="py-string">'12'</tt><tt class="py-op">:</tt> <tt class="py-string">'Configuration/diagnostics partition'</tt><tt class="py-op">,</tt> <tt class="py-string">'2A'</tt><tt class="py-op">:</tt> <tt class="py-string">'AtheOS File System (AFS)'</tt><tt class="py-op">,</tt> <tt class="py-string">'2B'</tt><tt class="py-op">:</tt> <tt class="py-string">'SyllableSecure (SylStor)'</tt><tt class="py-op">,</tt> <tt class="py-string">'14'</tt><tt class="py-op">:</tt> <tt class="py-string">'Hidden DOS 16-bit FAT &lt;32M or AST DOS with logically sectored FAT'</tt><tt class="py-op">,</tt> <tt class="py-string">'F6'</tt><tt class="py-op">:</tt> <tt class="py-string">'Storage Dimensions SpeedStor'</tt><tt class="py-op">,</tt> <tt class="py-string">'61'</tt><tt class="py-op">:</tt> <tt class="py-string">'SpeedStor'</tt><tt class="py-op">,</tt> <tt class="py-string">'55'</tt><tt class="py-op">:</tt> <tt class="py-string">'EZ-Drive'</tt><tt class="py-op">,</tt> <tt class="py-string">'54'</tt><tt class="py-op">:</tt> <tt class="py-string">'Disk Manager 6.0 Dynamic Drive Overlay (DDO)'</tt><tt class="py-op">,</tt> <tt class="py-string">'57'</tt><tt class="py-op">:</tt> <tt class="py-string">'DrivePro or VNDI Partition'</tt><tt class="py-op">,</tt> <tt class="py-string">'56'</tt><tt class="py-op">:</tt> <tt class="py-string">'Golden Bow VFeature Partitioned Volume. or DM converted to EZ-BIOS or AT&amp;T MS-DOS 3.x logically sectored FAT.'</tt><tt class="py-op">,</tt> <tt class="py-string">'51'</tt><tt class="py-op">:</tt> <tt class="py-string">'OnTrack Disk Manager RW (DM6 Aux1) or Novell'</tt><tt class="py-op">,</tt> <tt class="py-string">'50'</tt><tt class="py-op">:</tt> <tt class="py-string">'OnTrack Disk Manager (older versions) RO or Lynx RTOS or Native Oberon (alt)'</tt><tt class="py-op">,</tt> <tt class="py-string">'53'</tt><tt class="py-op">:</tt> <tt class="py-string">'Disk Manager 6.0 Aux3'</tt><tt class="py-op">,</tt> <tt class="py-string">'52'</tt><tt class="py-op">:</tt> <tt class="py-string">'CP/M or Microport SysV/AT'</tt><tt class="py-op">,</tt> <tt class="py-string">'B4'</tt><tt class="py-op">:</tt> <tt class="py-string">'HP Volume Expansion (SpeedStor variant)'</tt><tt class="py-op">,</tt> <tt class="py-string">'B6'</tt><tt class="py-op">:</tt> <tt class="py-string">'HP Volume Expansion (SpeedStor variant) or Corrupted Windows NT mirror set (master), FAT16 file system'</tt><tt class="py-op">,</tt> <tt class="py-string">'B7'</tt><tt class="py-op">:</tt> <tt class="py-string">'Corrupted Windows NT mirror set (master), NTFS file system or BSDI BSD/386 filesystem'</tt><tt class="py-op">,</tt> <tt class="py-string">'B0'</tt><tt class="py-op">:</tt> <tt class="py-string">'BootStar Dummy'</tt><tt class="py-op">,</tt> <tt class="py-string">'B1'</tt><tt class="py-op">:</tt> <tt class="py-string">'HP Volume Expansion (SpeedStor variant) or QNX Neutrino Power-Safe filesystem'</tt><tt class="py-op">,</tt> <tt class="py-string">'B2'</tt><tt class="py-op">:</tt> <tt class="py-string">'QNX Neutrino Power-Safe filesystem'</tt><tt class="py-op">,</tt> <tt class="py-string">'B3'</tt><tt class="py-op">:</tt> <tt class="py-string">'HP Volume Expansion (SpeedStor variant) or QNX Neutrino Power-Safe filesystem'</tt><tt class="py-op">,</tt> <tt class="py-string">'1E'</tt><tt class="py-op">:</tt> <tt class="py-string">'Hidden WIN95 16-bit FAT, LBA-mapped'</tt><tt class="py-op">,</tt> <tt class="py-string">'1C'</tt><tt class="py-op">:</tt> <tt class="py-string">'Hidden WIN95 OSR2 FAT32, LBA-mapped'</tt><tt class="py-op">,</tt> <tt class="py-string">'B8'</tt><tt class="py-op">:</tt> <tt class="py-string">'BSDI BSD/386 swap partition'</tt><tt class="py-op">,</tt> <tt class="py-string">'65'</tt><tt class="py-op">:</tt> <tt class="py-string">'Novell Netware 386, 3.xx or 4.xx'</tt><tt class="py-op">,</tt> <tt class="py-string">'66'</tt><tt class="py-op">:</tt> <tt class="py-string">'Novell Netware SMS Partition'</tt><tt class="py-op">,</tt> <tt class="py-string">'88'</tt><tt class="py-op">:</tt> <tt class="py-string">'Linux plaintext partition table'</tt><tt class="py-op">,</tt> <tt class="py-string">'82'</tt><tt class="py-op">:</tt> <tt class="py-string">'Prime or Solaris x86 or Linux swap'</tt><tt class="py-op">,</tt> <tt class="py-string">'3B'</tt><tt class="py-op">:</tt> <tt class="py-string">'THEOS ver 4 extended partition'</tt><tt class="py-op">,</tt> <tt class="py-string">'3A'</tt><tt class="py-op">:</tt> <tt class="py-string">'THEOS ver 4 4gb partition'</tt><tt class="py-op">,</tt> <tt class="py-string">'81'</tt><tt class="py-op">:</tt> <tt class="py-string">'MINIX since 1.4b, early Linux or Mitac disk manager'</tt><tt class="py-op">,</tt> <tt class="py-string">'86'</tt><tt class="py-op">:</tt> <tt class="py-string">'Old Linux RAID partition superblock or FAT16 volume set'</tt><tt class="py-op">,</tt> <tt class="py-string">'87'</tt><tt class="py-op">:</tt> <tt class="py-string">'NTFS volume set'</tt><tt class="py-op">,</tt> <tt class="py-string">'84'</tt><tt class="py-op">:</tt> <tt class="py-string">'OS/2 hidden C: drive or Hibernation partition'</tt><tt class="py-op">,</tt> <tt class="py-string">'85'</tt><tt class="py-op">:</tt> <tt class="py-string">'Linux extended partition'</tt><tt class="py-op">,</tt> <tt class="py-string">'02'</tt><tt class="py-op">:</tt> <tt class="py-string">'XENIX root'</tt><tt class="py-op">,</tt> <tt class="py-string">'03'</tt><tt class="py-op">:</tt> <tt class="py-string">'XENIX /usr'</tt><tt class="py-op">,</tt> <tt class="py-string">'00'</tt><tt class="py-op">:</tt> <tt class="py-string">'Empty'</tt><tt class="py-op">,</tt> <tt class="py-string">'01'</tt><tt class="py-op">:</tt> <tt class="py-string">'DOS 12-bit FAT'</tt><tt class="py-op">,</tt> <tt class="py-string">'06'</tt><tt class="py-op">:</tt> <tt class="py-string">'DOS 3.31+ 16-bit FAT (over 32M)'</tt><tt class="py-op">,</tt> <tt class="py-string">'07'</tt><tt class="py-op">:</tt> <tt class="py-string">'Windows NT NTFS or OS/2 IFS (e.g., HPFS) or exFAT or Advanced Unix or QNX2.x pre-1988'</tt><tt class="py-op">,</tt> <tt class="py-string">'04'</tt><tt class="py-op">:</tt> <tt class="py-string">'DOS 3.0+ 16-bit FAT (up to 32M)'</tt><tt class="py-op">,</tt> <tt class="py-string">'05'</tt><tt class="py-op">:</tt> <tt class="py-string">'DOS 3.3+ Extended Partition'</tt><tt class="py-op">,</tt> <tt class="py-string">'08'</tt><tt class="py-op">:</tt> <tt class="py-string">'OS/2 (v1.0-1.3 only) or AIX boot partition or SplitDrive or Commodore DOS or DELL partition spanning multiple drives or QNX 1.x and 2.x ("qny")'</tt><tt class="py-op">,</tt> <tt class="py-string">'09'</tt><tt class="py-op">:</tt> <tt class="py-string">'AIX data partition or Coherent filesystem or QNX 1.x and 2.x ("qnz")'</tt><tt class="py-op">,</tt> <tt class="py-string">'E8'</tt><tt class="py-op">:</tt> <tt class="py-string">'LUKS'</tt><tt class="py-op">,</tt> <tt class="py-string">'E5'</tt><tt class="py-op">:</tt> <tt class="py-string">'Tandy MSDOS with logically sectored FAT'</tt><tt class="py-op">,</tt> <tt class="py-string">'E4'</tt><tt class="py-op">:</tt> <tt class="py-string">'SpeedStor 16-bit FAT extended partition &lt; 1024 cyl.'</tt><tt class="py-op">,</tt> <tt class="py-string">'F5'</tt><tt class="py-op">:</tt> <tt class="py-string">'Prologue multi-volume partition'</tt><tt class="py-op">,</tt> <tt class="py-string">'E6'</tt><tt class="py-op">:</tt> <tt class="py-string">'Storage Dimensions SpeedStor'</tt><tt class="py-op">,</tt> <tt class="py-string">'E1'</tt><tt class="py-op">:</tt> <tt class="py-string">'DOS access or SpeedStor 12-bit FAT extended partition'</tt><tt class="py-op">,</tt> <tt class="py-string">'E0'</tt><tt class="py-op">:</tt> <tt class="py-string">'Reserved by STMicroelectronics for a filesystem called ST AVFS.'</tt><tt class="py-op">,</tt> <tt class="py-string">'E3'</tt><tt class="py-op">:</tt> <tt class="py-string">'DOS R/O or SpeedStor'</tt><tt class="py-op">,</tt> <tt class="py-string">'EE'</tt><tt class="py-op">:</tt> <tt class="py-string">'Indication that this legacy MBR is followed by an EFI header'</tt><tt class="py-op">,</tt> <tt class="py-string">'ED'</tt><tt class="py-op">:</tt> <tt class="py-string">'Unused'</tt><tt class="py-op">,</tt> <tt class="py-string">'EF'</tt><tt class="py-op">:</tt> <tt class="py-string">'Partition that contains an EFI file system'</tt><tt class="py-op">,</tt> <tt class="py-string">'EC'</tt><tt class="py-op">:</tt> <tt class="py-string">'SkyOS SkyFS'</tt><tt class="py-op">,</tt> <tt class="py-string">'EB'</tt><tt class="py-op">:</tt> <tt class="py-string">'BeOS BFS'</tt><tt class="py-op">,</tt> <tt class="py-string">'0B'</tt><tt class="py-op">:</tt> <tt class="py-string">'WIN95 OSR2 FAT32'</tt><tt class="py-op">,</tt> <tt class="py-string">'0C'</tt><tt class="py-op">:</tt> <tt class="py-string">'WIN95 OSR2 FAT32, LBA-mapped'</tt><tt class="py-op">,</tt> <tt class="py-string">'0A'</tt><tt class="py-op">:</tt> <tt class="py-string">'OS/2 Boot Manager or Coherent swap partition or OPUS'</tt><tt class="py-op">,</tt> <tt class="py-string">'0F'</tt><tt class="py-op">:</tt> <tt class="py-string">'WIN95: Extended partition, LBA-mapped'</tt><tt class="py-op">,</tt> <tt class="py-string">'0E'</tt><tt class="py-op">:</tt> <tt class="py-string">'WIN95: DOS 16-bit FAT, LBA-mapped'</tt><tt class="py-op">,</tt> <tt class="py-string">'39'</tt><tt class="py-op">:</tt> <tt class="py-string">'Plan 9 partition or THEOS ver 4 spanned partition'</tt><tt class="py-op">,</tt> <tt class="py-string">'38'</tt><tt class="py-op">:</tt> <tt class="py-string">'THEOS ver 3.2 2gb partition'</tt><tt class="py-op">,</tt> <tt class="py-string">'8B'</tt><tt class="py-op">:</tt> <tt class="py-string">'Legacy Fault Tolerant FAT32 volume'</tt><tt class="py-op">,</tt> <tt class="py-string">'8C'</tt><tt class="py-op">:</tt> <tt class="py-string">'Legacy Fault Tolerant FAT32 volume using BIOS extd INT 13h'</tt><tt class="py-op">,</tt> <tt class="py-string">'31'</tt><tt class="py-op">:</tt> <tt class="py-string">'Reserved'</tt><tt class="py-op">,</tt> <tt class="py-string">'8A'</tt><tt class="py-op">:</tt> <tt class="py-string">'Linux Kernel Partition (used by AiR-BOOT)'</tt><tt class="py-op">,</tt> <tt class="py-string">'36'</tt><tt class="py-op">:</tt> <tt class="py-string">'Reserved'</tt><tt class="py-op">,</tt> <tt class="py-string">'8D'</tt><tt class="py-op">:</tt> <tt class="py-string">'Free FDISK 0.96+ hidden Primary DOS FAT12 partitition'</tt><tt class="py-op">,</tt> <tt class="py-string">'8E'</tt><tt class="py-op">:</tt> <tt class="py-string">'Linux Logical Volume Manager partition'</tt><tt class="py-op">,</tt> <tt class="py-string">'FA'</tt><tt class="py-op">:</tt> <tt class="py-string">'Bochs'</tt><tt class="py-op">,</tt> <tt class="py-string">'FB'</tt><tt class="py-op">:</tt> <tt class="py-string">'VMware File System partition'</tt><tt class="py-op">,</tt> <tt class="py-string">'FC'</tt><tt class="py-op">:</tt> <tt class="py-string">'VMware Swap partition'</tt><tt class="py-op">,</tt> <tt class="py-string">'64'</tt><tt class="py-op">:</tt> <tt class="py-string">'PC-ARMOUR protected partition or Novell Netware 286, 2.xx'</tt><tt class="py-op">,</tt> <tt class="py-string">'FE'</tt><tt class="py-op">:</tt> <tt class="py-string">'SpeedStor &gt; 1024 cyl. or LANstep or IBM PS/2 IML (Initial Microcode Load) partition, located at the end of the disk. or Windows NT Disk Administrator hidden partition or Linux Logical Volume Manager partition (old)'</tt><tt class="py-op">,</tt> <tt class="py-string">'FF'</tt><tt class="py-op">:</tt> <tt class="py-string">'Xenix Bad Block Table'</tt><tt class="py-op">,</tt> <tt class="py-string">'67'</tt><tt class="py-op">:</tt> <tt class="py-string">'Novell'</tt><tt class="py-op">,</tt> <tt class="py-string">'68'</tt><tt class="py-op">:</tt> <tt class="py-string">'Novell'</tt><tt class="py-op">,</tt> <tt class="py-string">'69'</tt><tt class="py-op">:</tt> <tt class="py-string">'Novell Netware 5+, Novell Netware NSS Partition'</tt><tt class="py-op">,</tt> <tt class="py-string">'F9'</tt><tt class="py-op">:</tt> <tt class="py-string">'pCache'</tt><tt class="py-op">,</tt> <tt class="py-string">'FD'</tt><tt class="py-op">:</tt> <tt class="py-string">'Linux raid partition with autodetect using persistent superblock'</tt><tt class="py-op">,</tt> <tt class="py-string">'9A'</tt><tt class="py-op">:</tt> <tt class="py-string">'Free FDISK 0.96+ hidden Primary DOS FAT16 partitition (LBA)'</tt><tt class="py-op">,</tt> <tt class="py-string">'9B'</tt><tt class="py-op">:</tt> <tt class="py-string">'Free FDISK 0.96+ hidden DOS extended partitition (LBA)'</tt><tt class="py-op">,</tt> <tt class="py-string">'9E'</tt><tt class="py-op">:</tt> <tt class="py-string">'ForthOS partition'</tt><tt class="py-op">,</tt> <tt class="py-string">'9F'</tt><tt class="py-op">:</tt> <tt class="py-string">'BSD/OS'</tt><tt class="py-op">,</tt> <tt class="py-string">'C9'</tt><tt class="py-op">:</tt> <tt class="py-string">'Reserved for DR-DOS 8.0+'</tt><tt class="py-op">,</tt> <tt class="py-string">'C8'</tt><tt class="py-op">:</tt> <tt class="py-string">'Reserved for DR-DOS 8.0+'</tt><tt class="py-op">,</tt> <tt class="py-string">'C3'</tt><tt class="py-op">:</tt> <tt class="py-string">'Hidden Linux swap'</tt><tt class="py-op">,</tt> <tt class="py-string">'C2'</tt><tt class="py-op">:</tt> <tt class="py-string">'Unused or Hidden Linux'</tt><tt class="py-op">,</tt> <tt class="py-string">'C1'</tt><tt class="py-op">:</tt> <tt class="py-string">'DRDOS/secured (FAT-12)'</tt><tt class="py-op">,</tt> <tt class="py-string">'C0'</tt><tt class="py-op">:</tt> <tt class="py-string">'CTOS or REAL/32 secure small partition or NTFT Partition or DR-DOS/Novell DOS secured partition'</tt><tt class="py-op">,</tt> <tt class="py-string">'C7'</tt><tt class="py-op">:</tt> <tt class="py-string">'Windows NT corrupted NTFS volume/stripe set or Syrinx boot'</tt><tt class="py-op">,</tt> <tt class="py-string">'C6'</tt><tt class="py-op">:</tt> <tt class="py-string">'DRDOS/secured (FAT-16, &gt;= 32M) or Windows NT corrupted FAT16 volume/stripe set'</tt><tt class="py-op">,</tt> <tt class="py-string">'C5'</tt><tt class="py-op">:</tt> <tt class="py-string">'DRDOS/secured (extended)'</tt><tt class="py-op">,</tt> <tt class="py-string">'C4'</tt><tt class="py-op">:</tt> <tt class="py-string">'DRDOS/secured (FAT-16, &lt; 32M)'</tt><tt class="py-op">,</tt> <tt class="py-string">'CC'</tt><tt class="py-op">:</tt> <tt class="py-string">'DR-DOS 7.04+ secured FAT32 (LBA)/'</tt><tt class="py-op">,</tt> <tt class="py-string">'CB'</tt><tt class="py-op">:</tt> <tt class="py-string">'DR-DOS 7.04+ secured FAT32 (CHS)/'</tt><tt class="py-op">,</tt> <tt class="py-string">'CA'</tt><tt class="py-op">:</tt> <tt class="py-string">'Reserved for DR-DOS 8.0+'</tt><tt class="py-op">,</tt> <tt class="py-string">'CF'</tt><tt class="py-op">:</tt> <tt class="py-string">'DR-DOS 7.04+ secured EXT DOS (LBA)/'</tt><tt class="py-op">,</tt> <tt class="py-string">'CE'</tt><tt class="py-op">:</tt> <tt class="py-string">'DR-DOS 7.04+ FAT16X (LBA)/'</tt><tt class="py-op">,</tt> <tt class="py-string">'CD'</tt><tt class="py-op">:</tt> <tt class="py-string">'CTOS Memdump?'</tt><tt class="py-op">,</tt> <tt class="py-string">'99'</tt><tt class="py-op">:</tt> <tt class="py-string">'DCE376 logical drive'</tt><tt class="py-op">,</tt> <tt class="py-string">'98'</tt><tt class="py-op">:</tt> <tt class="py-string">'Free FDISK 0.96+ hidden Primary DOS FAT32 partitition (LBA) or Datalight ROM-DOS Super-Boot Partition'</tt><tt class="py-op">,</tt> <tt class="py-string">'91'</tt><tt class="py-op">:</tt> <tt class="py-string">'Free FDISK 0.96+ hidden DOS extended partitition'</tt><tt class="py-op">,</tt> <tt class="py-string">'90'</tt><tt class="py-op">:</tt> <tt class="py-string">'Free FDISK 0.96+ hidden Primary DOS FAT16 partitition'</tt><tt class="py-op">,</tt> <tt class="py-string">'93'</tt><tt class="py-op">:</tt> <tt class="py-string">'Hidden Linux native partition or Amoeba'</tt><tt class="py-op">,</tt> <tt class="py-string">'92'</tt><tt class="py-op">:</tt> <tt class="py-string">'Free FDISK 0.96+ hidden Primary DOS large FAT16 partitition'</tt><tt class="py-op">,</tt> <tt class="py-string">'95'</tt><tt class="py-op">:</tt> <tt class="py-string">'MIT EXOPC native partitions'</tt><tt class="py-op">,</tt> <tt class="py-string">'94'</tt><tt class="py-op">:</tt> <tt class="py-string">'Amoeba bad block table'</tt><tt class="py-op">,</tt> <tt class="py-string">'97'</tt><tt class="py-op">:</tt> <tt class="py-string">'Free FDISK 0.96+ hidden Primary DOS FAT32 partitition'</tt><tt class="py-op">,</tt> <tt class="py-string">'96'</tt><tt class="py-op">:</tt> <tt class="py-string">'CHRP ISO-9660 filesystem'</tt><tt class="py-op">,</tt> <tt class="py-string">'F0'</tt><tt class="py-op">:</tt> <tt class="py-string">'Linux/PA-RISC boot loader'</tt><tt class="py-op">,</tt> <tt class="py-string">'F1'</tt><tt class="py-op">:</tt> <tt class="py-string">'Storage Dimensions SpeedStor'</tt><tt class="py-op">,</tt> <tt class="py-string">'F2'</tt><tt class="py-op">:</tt> <tt class="py-string">'DOS 3.3+ secondary partition'</tt><tt class="py-op">,</tt> <tt class="py-string">'F3'</tt><tt class="py-op">:</tt> <tt class="py-string">'Reserved'</tt><tt class="py-op">,</tt> <tt class="py-string">'F4'</tt><tt class="py-op">:</tt> <tt class="py-string">'SpeedStor large partition or Prologue single-volume partition'</tt><tt class="py-op">,</tt> <tt class="py-string">'6E'</tt><tt class="py-op">:</tt> <tt class="py-string">'??'</tt><tt class="py-op">,</tt> <tt class="py-string">'17'</tt><tt class="py-op">:</tt> <tt class="py-string">'Hidden IFS (e.g., HPFS)'</tt><tt class="py-op">,</tt> <tt class="py-string">'F7'</tt><tt class="py-op">:</tt> <tt class="py-string">'DDRdrive Solid State File System'</tt><tt class="py-op">,</tt> <tt class="py-string">'19'</tt><tt class="py-op">:</tt> <tt class="py-string">'Unused'</tt><tt class="py-op">,</tt> <tt class="py-string">'18'</tt><tt class="py-op">:</tt> <tt class="py-string">'AST SmartSleep Partition'</tt><tt class="py-op">,</tt> <tt class="py-string">'33'</tt><tt class="py-op">:</tt> <tt class="py-string">'Reserved'</tt><tt class="py-op">,</tt> <tt class="py-string">'32'</tt><tt class="py-op">:</tt> <tt class="py-string">'NOS'</tt><tt class="py-op">,</tt> <tt class="py-string">'DF'</tt><tt class="py-op">:</tt> <tt class="py-string">'DG/UX virtual disk manager partition or BootIt EMBRM'</tt><tt class="py-op">,</tt> <tt class="py-string">'DD'</tt><tt class="py-op">:</tt> <tt class="py-string">'Hidden CTOS Memdump?'</tt><tt class="py-op">,</tt> <tt class="py-string">'DE'</tt><tt class="py-op">:</tt> <tt class="py-string">'Dell PowerEdge Server utilities (FAT fs)'</tt><tt class="py-op">,</tt> <tt class="py-string">'DB'</tt><tt class="py-op">:</tt> <tt class="py-string">'Digital Research CP/M, Concurrent CP/M, Concurrent DOS or CTOS (Convergent Technologies OS -Unisys) or KDG Telemetry SCPU boot'</tt><tt class="py-op">,</tt> <tt class="py-string">'DA'</tt><tt class="py-op">:</tt> <tt class="py-string">'Non-FS Data or Powercopy Backup'</tt><tt class="py-op">,</tt> <tt class="py-string">'3C'</tt><tt class="py-op">:</tt> <tt class="py-string">'PartitionMagic recovery partition'</tt><tt class="py-op">,</tt> <tt class="py-string">'35'</tt><tt class="py-op">:</tt> <tt class="py-string">'JFS on OS/2 or eCS'</tt><tt class="py-op">,</tt> <tt class="py-string">'83'</tt><tt class="py-op">:</tt> <tt class="py-string">'Linux native partition'</tt><tt class="py-op">,</tt> <tt class="py-string">'34'</tt><tt class="py-op">:</tt> <tt class="py-string">'Reserved'</tt><tt class="py-op">,</tt> <tt class="py-string">'80'</tt><tt class="py-op">:</tt> <tt class="py-string">'MINIX until 1.4a'</tt><tt class="py-op">,</tt> <tt class="py-string">'7F'</tt><tt class="py-op">:</tt> <tt class="py-string">'Unused'</tt><tt class="py-op">,</tt> <tt class="py-string">'7E'</tt><tt class="py-op">:</tt> <tt class="py-string">'Unused'</tt><tt class="py-op">,</tt> <tt class="py-string">'48'</tt><tt class="py-op">:</tt> <tt class="py-string">'EUMEL/Elan'</tt><tt class="py-op">,</tt> <tt class="py-string">'63'</tt><tt class="py-op">:</tt> <tt class="py-string">'Unix System V (SCO, ISC Unix, UnixWare, ...), Mach, GNU Hurd'</tt><tt class="py-op">,</tt> <tt class="py-string">'47'</tt><tt class="py-op">:</tt> <tt class="py-string">'EUMEL/Elan'</tt><tt class="py-op">,</tt> <tt class="py-string">'44'</tt><tt class="py-op">:</tt> <tt class="py-string">'GoBack partition'</tt><tt class="py-op">,</tt> <tt class="py-string">'45'</tt><tt class="py-op">:</tt> <tt class="py-string">'Boot-US boot manager or Priam or EUMEL/Elan'</tt><tt class="py-op">,</tt> <tt class="py-string">'42'</tt><tt class="py-op">:</tt> <tt class="py-string">'Linux swap (sharing disk with DRDOS) or SFS (Secure Filesystem) or Windows 2000 dynamic extended partition marker'</tt><tt class="py-op">,</tt> <tt class="py-string">'43'</tt><tt class="py-op">:</tt> <tt class="py-string">'Linux native (sharing disk with DRDOS)'</tt><tt class="py-op">,</tt> <tt class="py-string">'40'</tt><tt class="py-op">:</tt> <tt class="py-string">'Venix 80286 or PICK'</tt><tt class="py-op">,</tt> <tt class="py-string">'41'</tt><tt class="py-op">:</tt> <tt class="py-string">'Linux/MINIX (sharing disk with DRDOS) or Personal RISC Boot or PPC PReP (Power PC Reference Platform) Boot'</tt><tt class="py-op">,</tt> <tt class="py-string">'A1'</tt><tt class="py-op">:</tt> <tt class="py-string">'Laptop hibernation partition or HP Volume Expansion (SpeedStor variant)'</tt><tt class="py-op">,</tt> <tt class="py-string">'A0'</tt><tt class="py-op">:</tt> <tt class="py-string">'Laptop hibernation partition'</tt><tt class="py-op">,</tt> <tt class="py-string">'A3'</tt><tt class="py-op">:</tt> <tt class="py-string">'HP Volume Expansion (SpeedStor variant)'</tt><tt class="py-op">,</tt> <tt class="py-string">'A5'</tt><tt class="py-op">:</tt> <tt class="py-string">'BSD/386, 386BSD, NetBSD, FreeBSD'</tt><tt class="py-op">,</tt> <tt class="py-string">'A4'</tt><tt class="py-op">:</tt> <tt class="py-string">'HP Volume Expansion (SpeedStor variant)'</tt><tt class="py-op">,</tt> <tt class="py-string">'A7'</tt><tt class="py-op">:</tt> <tt class="py-string">'NeXTStep'</tt><tt class="py-op">,</tt> <tt class="py-string">'A6'</tt><tt class="py-op">:</tt> <tt class="py-string">'OpenBSD or HP Volume Expansion (SpeedStor variant)'</tt><tt class="py-op">,</tt> <tt class="py-string">'A9'</tt><tt class="py-op">:</tt> <tt class="py-string">'NetBSD'</tt><tt class="py-op">,</tt> <tt class="py-string">'A8'</tt><tt class="py-op">:</tt> <tt class="py-string">'Mac OS-X'</tt><tt class="py-op">,</tt> <tt class="py-string">'3D'</tt><tt class="py-op">:</tt> <tt class="py-string">'Hidden NetWare'</tt><tt class="py-op">,</tt> <tt class="py-string">'AA'</tt><tt class="py-op">:</tt> <tt class="py-string">'Olivetti Fat 12 1.44MB Service Partition'</tt><tt class="py-op">,</tt> <tt class="py-string">'AB'</tt><tt class="py-op">:</tt> <tt class="py-string">'Mac OS-X Boot partition or GO! partition'</tt><tt class="py-op">,</tt> <tt class="py-string">'AE'</tt><tt class="py-op">:</tt> <tt class="py-string">'ShagOS filesystem'</tt><tt class="py-op">,</tt> <tt class="py-string">'AF'</tt><tt class="py-op">:</tt> <tt class="py-string">'ShagOS swap partition or MacOS X HFS'</tt><tt class="py-op">,</tt> <tt class="py-string">'77'</tt><tt class="py-op">:</tt> <tt class="py-string">'M2FS/M2CS partition or VNDI Partition'</tt><tt class="py-op">,</tt> <tt class="py-string">'76'</tt><tt class="py-op">:</tt> <tt class="py-string">'Reserved'</tt><tt class="py-op">,</tt> <tt class="py-string">'75'</tt><tt class="py-op">:</tt> <tt class="py-string">'IBM PC/IX'</tt><tt class="py-op">,</tt> <tt class="py-string">'74'</tt><tt class="py-op">:</tt> <tt class="py-string">'Reserved or Scramdisk partition'</tt><tt class="py-op">,</tt> <tt class="py-string">'73'</tt><tt class="py-op">:</tt> <tt class="py-string">'Reserved'</tt><tt class="py-op">,</tt> <tt class="py-string">'72'</tt><tt class="py-op">:</tt> <tt class="py-string">'V7/x86'</tt><tt class="py-op">,</tt> <tt class="py-string">'71'</tt><tt class="py-op">:</tt> <tt class="py-string">'Reserved'</tt><tt class="py-op">,</tt> <tt class="py-string">'70'</tt><tt class="py-op">:</tt> <tt class="py-string">'DiskSecure Multi-Boot'</tt><tt class="py-op">,</tt> <tt class="py-string">'4F'</tt><tt class="py-op">:</tt> <tt class="py-string">'QNX4.x 3rd part or Oberon partition'</tt><tt class="py-op">,</tt> <tt class="py-string">'4D'</tt><tt class="py-op">:</tt> <tt class="py-string">'QNX4.x'</tt><tt class="py-op">,</tt> <tt class="py-string">'4E'</tt><tt class="py-op">:</tt> <tt class="py-string">'QNX4.x 2nd part'</tt><tt class="py-op">,</tt> <tt class="py-string">'4C'</tt><tt class="py-op">:</tt> <tt class="py-string">'Oberon partition'</tt><tt class="py-op">,</tt> <tt class="py-string">'78'</tt><tt class="py-op">:</tt> <tt class="py-string">'XOSL FS'</tt><tt class="py-op">,</tt> <tt class="py-string">'46'</tt><tt class="py-op">:</tt> <tt class="py-string">'EUMEL/Elan'</tt><tt class="py-op">,</tt> <tt class="py-string">'D8'</tt><tt class="py-op">:</tt> <tt class="py-string">'CP/M-86'</tt><tt class="py-op">,</tt> <tt class="py-string">'D6'</tt><tt class="py-op">:</tt> <tt class="py-string">'Old Multiuser DOS secured FAT16 &gt;=32M'</tt><tt class="py-op">,</tt> <tt class="py-string">'D4'</tt><tt class="py-op">:</tt> <tt class="py-string">'Old Multiuser DOS secured FAT16 &lt;32M'</tt><tt class="py-op">,</tt> <tt class="py-string">'D5'</tt><tt class="py-op">:</tt> <tt class="py-string">'Old Multiuser DOS secured extended partition'</tt><tt class="py-op">,</tt> <tt class="py-string">'D0'</tt><tt class="py-op">:</tt> <tt class="py-string">'REAL/32 secure big partition or Multiuser DOS secured partition'</tt><tt class="py-op">,</tt> <tt class="py-string">'D1'</tt><tt class="py-op">:</tt> <tt class="py-string">'Old Multiuser DOS secured FAT12'</tt><tt class="py-op">}</tt> </tt>
<a name="L20"></a><tt class="py-lineno"> 20</tt>  <tt class="py-line">                <tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">supported_commands</tt> <tt class="py-op">=</tt> <tt class="py-op">(</tt><tt class="py-string">'hex'</tt><tt class="py-op">,</tt> <tt class="py-string">'mbr'</tt><tt class="py-op">,</tt> <tt class="py-string">'fat-vbr'</tt><tt class="py-op">,</tt> <tt class="py-string">'date'</tt><tt class="py-op">,</tt> <tt class="py-string">'time'</tt><tt class="py-op">,</tt> <tt class="py-string">'datetime'</tt><tt class="py-op">,</tt> <tt class="py-string">'little-endian'</tt><tt class="py-op">,</tt> <tt class="py-string">'big-endian'</tt><tt class="py-op">)</tt> </tt>
<a name="L21"></a><tt class="py-lineno"> 21</tt>  <tt class="py-line">                <tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">command_descriptions</tt> <tt class="py-op">=</tt> <tt class="py-op">{</tt> </tt>
<a name="L22"></a><tt class="py-lineno"> 22</tt>  <tt class="py-line">                        <tt class="py-string">'hex'</tt><tt class="py-op">:</tt> <tt class="py-string">'The default interpretation mode. Presents the input in a fixed-width font along with its ASCII decoding. All other commands fall back to this interpretation if an error occurs.'</tt><tt class="py-op">,</tt>  </tt>
<a name="L23"></a><tt class="py-lineno"> 23</tt>  <tt class="py-line">                        <tt class="py-string">'mbr'</tt><tt class="py-op">:</tt> <tt class="py-string">'Analyzes the given input as a Master Boot Record.'</tt><tt class="py-op">,</tt>  </tt>
<a name="L24"></a><tt class="py-lineno"> 24</tt>  <tt class="py-line">                        <tt class="py-string">'fat-vbr'</tt><tt class="py-op">:</tt> <tt class="py-string">'Analyzes the given input as a Boot Sector for an FAT volume.'</tt><tt class="py-op">,</tt>  </tt>
<a name="L25"></a><tt class="py-lineno"> 25</tt>  <tt class="py-line">                        <tt class="py-string">'date'</tt><tt class="py-op">:</tt> <tt class="py-string">'Analyzes the given input as an FAT date value.'</tt><tt class="py-op">,</tt>  </tt>
<a name="L26"></a><tt class="py-lineno"> 26</tt>  <tt class="py-line">                        <tt class="py-string">'time'</tt><tt class="py-op">:</tt> <tt class="py-string">'Analyzes the given input as an FAT time value.'</tt><tt class="py-op">,</tt>  </tt>
<a name="L27"></a><tt class="py-lineno"> 27</tt>  <tt class="py-line">                        <tt class="py-string">'datetime'</tt><tt class="py-op">:</tt> <tt class="py-string">'Analyzes the given input as FAT date and time values.'</tt><tt class="py-op">,</tt>  </tt>
<a name="L28"></a><tt class="py-lineno"> 28</tt>  <tt class="py-line">                        <tt class="py-string">'little-endian'</tt><tt class="py-op">:</tt> <tt class="py-string">'A sub-command, to be used with one of the other commands above. Tells Forensie to process the input for little endian format.'</tt><tt class="py-op">,</tt>  </tt>
<a name="L29"></a><tt class="py-lineno"> 29</tt>  <tt class="py-line">                        <tt class="py-string">'big-endian'</tt><tt class="py-op">:</tt> <tt class="py-string">'A sub-command, to be used with one of the other commands above. Tells Forensie to process the input for big endian format.'</tt><tt class="py-op">}</tt> </tt>
</div><a name="L30"></a><tt class="py-lineno"> 30</tt>  <tt class="py-line">         </tt>
<a name="Forensie.RemoveDelimiters"></a><div id="Forensie.RemoveDelimiters-def"><a name="L31"></a><tt class="py-lineno"> 31</tt> <a class="py-toggle" href="#" id="Forensie.RemoveDelimiters-toggle" onclick="return toggle('Forensie.RemoveDelimiters');">-</a><tt class="py-line">        <tt class="py-keyword">def</tt> <a class="py-def-name" href="Forensie.Forensie-class.html#RemoveDelimiters">RemoveDelimiters</a><tt class="py-op">(</tt><tt class="py-param">self</tt><tt class="py-op">)</tt><tt class="py-op">:</tt> </tt>
</div><div id="Forensie.RemoveDelimiters-collapsed" style="display:none;" pad="+++" indent="++++++++++++"></div><div id="Forensie.RemoveDelimiters-expanded"><a name="L32"></a><tt class="py-lineno"> 32</tt>  <tt class="py-line">                <tt class="py-docstring">"""Removes standard delimiting characters from the input text. No </tt> </tt>
<a name="L33"></a><tt class="py-lineno"> 33</tt>  <tt class="py-line"><tt class="py-docstring">                return value. Instead, self.inputStr is changed directly.</tt> </tt>
<a name="L34"></a><tt class="py-lineno"> 34</tt>  <tt class="py-line"><tt class="py-docstring">                """</tt> </tt>
<a name="L35"></a><tt class="py-lineno"> 35</tt>  <tt class="py-line">                <tt class="py-name">badchars</tt> <tt class="py-op">=</tt> <tt class="py-string">' -|\n'</tt> </tt>
<a name="L36"></a><tt class="py-lineno"> 36</tt>  <tt class="py-line">                <tt class="py-keyword">try</tt><tt class="py-op">:</tt> </tt>
<a name="L37"></a><tt class="py-lineno"> 37</tt>  <tt class="py-line">                        <tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">inputStr</tt> <tt class="py-op">=</tt> <tt class="py-name">str</tt><tt class="py-op">(</tt><tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">inputStr</tt><tt class="py-op">)</tt><tt class="py-op">.</tt><tt class="py-name">translate</tt><tt class="py-op">(</tt><tt class="py-name">None</tt><tt class="py-op">,</tt> <tt class="py-name">badchars</tt><tt class="py-op">)</tt> <tt class="py-comment"># Removes all spaces and pipes from input string</tt> </tt>
<a name="L38"></a><tt class="py-lineno"> 38</tt>  <tt class="py-line">                <tt class="py-keyword">except</tt><tt class="py-op">(</tt><tt class="py-name">TypeError</tt><tt class="py-op">)</tt><tt class="py-op">:</tt> <tt class="py-comment"># Python 2.5 doesn't support None translation tables...</tt> </tt>
<a name="L39"></a><tt class="py-lineno"> 39</tt>  <tt class="py-line">                        <tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">inputStr</tt> <tt class="py-op">=</tt> <tt class="py-name">str</tt><tt class="py-op">(</tt><tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">inputStr</tt><tt class="py-op">)</tt><tt class="py-op">.</tt><tt class="py-name">translate</tt><tt class="py-op">(</tt><tt class="py-name">string</tt><tt class="py-op">.</tt><tt class="py-name">maketrans</tt><tt class="py-op">(</tt><tt class="py-string">''</tt><tt class="py-op">,</tt> <tt class="py-string">''</tt><tt class="py-op">)</tt><tt class="py-op">,</tt> <tt class="py-name">badchars</tt><tt class="py-op">)</tt> </tt>
</div><a name="L40"></a><tt class="py-lineno"> 40</tt>  <tt class="py-line">         </tt>
<a name="Forensie.ProcessInput"></a><div id="Forensie.ProcessInput-def"><a name="L41"></a><tt class="py-lineno"> 41</tt> <a class="py-toggle" href="#" id="Forensie.ProcessInput-toggle" onclick="return toggle('Forensie.ProcessInput');">-</a><tt class="py-line">        <tt class="py-keyword">def</tt> <a class="py-def-name" href="Forensie.Forensie-class.html#ProcessInput">ProcessInput</a><tt class="py-op">(</tt><tt class="py-param">self</tt><tt class="py-op">,</tt> <tt class="py-param">repeatOnFail</tt><tt class="py-op">=</tt><tt class="py-number">0</tt><tt class="py-op">)</tt><tt class="py-op">:</tt> </tt>
</div><div id="Forensie.ProcessInput-collapsed" style="display:none;" pad="+++" indent="++++++++++++"></div><div id="Forensie.ProcessInput-expanded"><a name="L42"></a><tt class="py-lineno"> 42</tt>  <tt class="py-line">                <tt class="py-docstring">"""Processes the text provided to the constructor. This method is the </tt> </tt>
<a name="L43"></a><tt class="py-lineno"> 43</tt>  <tt class="py-line"><tt class="py-docstring">                flagship of Forensie. All processing of text springboards from this </tt> </tt>
<a name="L44"></a><tt class="py-lineno"> 44</tt>  <tt class="py-line"><tt class="py-docstring">                point. First the type of the input is determined, hex, binary, or </tt> </tt>
<a name="L45"></a><tt class="py-lineno"> 45</tt>  <tt class="py-line"><tt class="py-docstring">                other. Binary text is converted to hex before futher processing. If </tt> </tt>
<a name="L46"></a><tt class="py-lineno"> 46</tt>  <tt class="py-line"><tt class="py-docstring">                neither binary nor hex text is found, the first line is parsed for </tt> </tt>
<a name="L47"></a><tt class="py-lineno"> 47</tt>  <tt class="py-line"><tt class="py-docstring">                commands and the rest of the lines are reprocessed for binary or </tt> </tt>
<a name="L48"></a><tt class="py-lineno"> 48</tt>  <tt class="py-line"><tt class="py-docstring">                hex text in a recursive manner. All commands are kept cummulatively </tt> </tt>
<a name="L49"></a><tt class="py-lineno"> 49</tt>  <tt class="py-line"><tt class="py-docstring">                and are processed in the order they were discovered.</tt> </tt>
<a name="L50"></a><tt class="py-lineno"> 50</tt>  <tt class="py-line"><tt class="py-docstring">                </tt> </tt>
<a name="L51"></a><tt class="py-lineno"> 51</tt>  <tt class="py-line"><tt class="py-docstring">                Returns a tuple in the form (printable results, 'success' or 'fail',</tt> </tt>
<a name="L52"></a><tt class="py-lineno"> 52</tt>  <tt class="py-line"><tt class="py-docstring">                type of processing done to input).</tt> </tt>
<a name="L53"></a><tt class="py-lineno"> 53</tt>  <tt class="py-line"><tt class="py-docstring">                """</tt> </tt>
<a name="L54"></a><tt class="py-lineno"> 54</tt>  <tt class="py-line">                <tt class="py-comment"># Check input format</tt> </tt>
<a name="L55"></a><tt class="py-lineno"> 55</tt>  <tt class="py-line">                <tt class="py-name">self</tt><tt class="py-op">.</tt><tt id="link-3" class="py-name" targets="Method Forensie.Forensie.CheckBinary()=Forensie.Forensie-class.html#CheckBinary"><a title="Forensie.Forensie.CheckBinary" class="py-name" href="#" onclick="return doclink('link-3', 'CheckBinary', 'link-3');">CheckBinary</a></tt><tt class="py-op">(</tt><tt class="py-op">)</tt> </tt>
<a name="L56"></a><tt class="py-lineno"> 56</tt>  <tt class="py-line">                <tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">bytes</tt> <tt class="py-op">=</tt> <tt class="py-op">[</tt><tt class="py-op">]</tt> </tt>
<a name="L57"></a><tt class="py-lineno"> 57</tt>  <tt class="py-line">                 </tt>
<a name="L58"></a><tt class="py-lineno"> 58</tt>  <tt class="py-line">                <tt class="py-keyword">if</tt> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">format</tt><tt class="py-op">[</tt><tt class="py-op">:</tt><tt class="py-number">3</tt><tt class="py-op">]</tt> <tt class="py-op">==</tt> <tt class="py-string">'bad'</tt> <tt class="py-keyword">or</tt> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">format</tt> <tt class="py-op">!=</tt> <tt class="py-string">'hex'</tt><tt class="py-op">:</tt> </tt>
<a name="L59"></a><tt class="py-lineno"> 59</tt>  <tt class="py-line">                        <tt class="py-keyword">if</tt> <tt class="py-name">type</tt><tt class="py-op">(</tt><tt class="py-name">repeatOnFail</tt><tt class="py-op">)</tt> <tt class="py-op">==</tt> <tt class="py-name">int</tt><tt class="py-op">:</tt> </tt>
<a name="L60"></a><tt class="py-lineno"> 60</tt>  <tt class="py-line">                                <tt class="py-name">line</tt> <tt class="py-op">=</tt> <tt class="py-number">2</tt><tt class="py-op">+</tt><tt class="py-name">repeatOnFail</tt> <tt class="py-comment"># Blip always starts with '\n'; don't want to count that line</tt> </tt>
<a name="L61"></a><tt class="py-lineno"> 61</tt>  <tt class="py-line">                                <tt class="py-comment">#print "Trying to split the lines...",</tt> </tt>
<a name="L62"></a><tt class="py-lineno"> 62</tt>  <tt class="py-line">                                <tt class="py-name">tmp</tt> <tt class="py-op">=</tt> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">origStr</tt><tt class="py-op">.</tt><tt class="py-name">split</tt><tt class="py-op">(</tt><tt class="py-string">'\n'</tt><tt class="py-op">,</tt> <tt class="py-name">line</tt><tt class="py-op">)</tt> </tt>
<a name="L63"></a><tt class="py-lineno"> 63</tt>  <tt class="py-line">                                <tt class="py-keyword">try</tt><tt class="py-op">:</tt> </tt>
<a name="L64"></a><tt class="py-lineno"> 64</tt>  <tt class="py-line">                                        <tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">inputStr</tt> <tt class="py-op">=</tt> <tt id="link-4" class="py-name" targets="Function Forensie.StrFlatten()=Forensie-module.html#StrFlatten"><a title="Forensie.StrFlatten" class="py-name" href="#" onclick="return doclink('link-4', 'StrFlatten', 'link-4');">StrFlatten</a></tt><tt class="py-op">(</tt><tt class="py-name">tmp</tt><tt class="py-op">[</tt><tt class="py-name">line</tt><tt class="py-op">:</tt><tt class="py-op">]</tt><tt class="py-op">)</tt> </tt>
<a name="L65"></a><tt class="py-lineno"> 65</tt>  <tt class="py-line">                                <tt class="py-keyword">except</tt> <tt class="py-name">IndexError</tt><tt class="py-op">:</tt> <tt class="py-comment"># No more lines to take off</tt> </tt>
<a name="L66"></a><tt class="py-lineno"> 66</tt>  <tt class="py-line">                                        <tt class="py-keyword">print</tt> <tt class="py-string">"Failed on try %d"</tt> <tt class="py-op">%</tt> <tt class="py-name">repeatOnFail</tt> </tt>
<a name="L67"></a><tt class="py-lineno"> 67</tt>  <tt class="py-line">                                        <tt class="py-keyword">return</tt> <tt class="py-op">(</tt><tt class="py-string">'Parsed all lines unsuccessfully.'</tt><tt class="py-op">,</tt> <tt class="py-string">'fail'</tt><tt class="py-op">,</tt> <tt class="py-name">None</tt><tt class="py-op">)</tt> </tt>
<a name="L68"></a><tt class="py-lineno"> 68</tt>  <tt class="py-line">                                <tt class="py-keyword">else</tt><tt class="py-op">:</tt> </tt>
<a name="L69"></a><tt class="py-lineno"> 69</tt>  <tt class="py-line">                                        <tt class="py-comment">#print 'Bad input format: %s\nTrying again, #%d' % (self.format, repeatOnFail+1)</tt> </tt>
<a name="L70"></a><tt class="py-lineno"> 70</tt>  <tt class="py-line">                                        <tt class="py-name">self</tt><tt class="py-op">.</tt><tt id="link-5" class="py-name" targets="Method Forensie.Forensie.GetCommand()=Forensie.Forensie-class.html#GetCommand"><a title="Forensie.Forensie.GetCommand" class="py-name" href="#" onclick="return doclink('link-5', 'GetCommand', 'link-5');">GetCommand</a></tt><tt class="py-op">(</tt><tt class="py-name">tmp</tt><tt class="py-op">[</tt><tt class="py-op">:</tt><tt class="py-name">line</tt><tt class="py-op">]</tt><tt class="py-op">)</tt> </tt>
<a name="L71"></a><tt class="py-lineno"> 71</tt>  <tt class="py-line">                                        <tt class="py-name">self</tt><tt class="py-op">.</tt><tt id="link-6" class="py-name"><a title="Forensie.Forensie.RemoveDelimiters" class="py-name" href="#" onclick="return doclink('link-6', 'RemoveDelimiters', 'link-2');">RemoveDelimiters</a></tt><tt class="py-op">(</tt><tt class="py-op">)</tt> </tt>
<a name="L72"></a><tt class="py-lineno"> 72</tt>  <tt class="py-line">                                        <tt class="py-keyword">return</tt> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt id="link-7" class="py-name" targets="Method Forensie.Forensie.ProcessInput()=Forensie.Forensie-class.html#ProcessInput"><a title="Forensie.Forensie.ProcessInput" class="py-name" href="#" onclick="return doclink('link-7', 'ProcessInput', 'link-7');">ProcessInput</a></tt><tt class="py-op">(</tt><tt class="py-name">repeatOnFail</tt><tt class="py-op">+</tt><tt class="py-number">1</tt><tt class="py-op">)</tt> </tt>
<a name="L73"></a><tt class="py-lineno"> 73</tt>  <tt class="py-line">                        <tt class="py-keyword">else</tt><tt class="py-op">:</tt> </tt>
<a name="L74"></a><tt class="py-lineno"> 74</tt>  <tt class="py-line">                                <tt class="py-keyword">return</tt> <tt class="py-op">(</tt><tt class="py-string">''</tt><tt class="py-op">,</tt> <tt class="py-string">'fail'</tt><tt class="py-op">,</tt> <tt class="py-name">None</tt><tt class="py-op">)</tt> </tt>
<a name="L75"></a><tt class="py-lineno"> 75</tt>  <tt class="py-line">                 </tt>
<a name="L76"></a><tt class="py-lineno"> 76</tt>  <tt class="py-line">                <tt class="py-comment"># Text is in an acceptable format. Process according to a command or process as hex text.</tt> </tt>
<a name="L77"></a><tt class="py-lineno"> 77</tt>  <tt class="py-line">                <tt class="py-keyword">try</tt><tt class="py-op">:</tt> </tt>
<a name="L78"></a><tt class="py-lineno"> 78</tt>  <tt class="py-line">                        <tt class="py-keyword">return</tt> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt id="link-8" class="py-name" targets="Method Forensie.Forensie.ExecuteCommand()=Forensie.Forensie-class.html#ExecuteCommand"><a title="Forensie.Forensie.ExecuteCommand" class="py-name" href="#" onclick="return doclink('link-8', 'ExecuteCommand', 'link-8');">ExecuteCommand</a></tt><tt class="py-op">(</tt><tt class="py-op">)</tt> </tt>
<a name="L79"></a><tt class="py-lineno"> 79</tt>  <tt class="py-line">                <tt class="py-keyword">except</tt> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt id="link-9" class="py-name" targets="Class Forensie.Forensie.FormatError=Forensie.Forensie.FormatError-class.html"><a title="Forensie.Forensie.FormatError" class="py-name" href="#" onclick="return doclink('link-9', 'FormatError', 'link-9');">FormatError</a></tt><tt class="py-op">,</tt> <tt class="py-name">m</tt><tt class="py-op">:</tt> </tt>
<a name="L80"></a><tt class="py-lineno"> 80</tt>  <tt class="py-line">                        <tt class="py-keyword">if</tt> <tt id="link-10" class="py-name"><a title="Forensie.F_DEBUG" class="py-name" href="#" onclick="return doclink('link-10', 'F_DEBUG', 'link-0');">F_DEBUG</a></tt><tt class="py-op">:</tt> <tt class="py-keyword">print</tt> <tt class="py-name">m</tt> </tt>
<a name="L81"></a><tt class="py-lineno"> 81</tt>  <tt class="py-line">                        <tt class="py-keyword">return</tt> <tt class="py-op">(</tt><tt class="py-string">'%s%s'</tt><tt class="py-op">%</tt><tt class="py-op">(</tt><tt class="py-name">m</tt><tt class="py-op">,</tt> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt id="link-11" class="py-name" targets="Method Forensie.Forensie.DecodeHex()=Forensie.Forensie-class.html#DecodeHex"><a title="Forensie.Forensie.DecodeHex" class="py-name" href="#" onclick="return doclink('link-11', 'DecodeHex', 'link-11');">DecodeHex</a></tt><tt class="py-op">(</tt><tt class="py-op">)</tt><tt class="py-op">)</tt><tt class="py-op">,</tt> <tt class="py-string">'success'</tt><tt class="py-op">,</tt> <tt class="py-string">'hex'</tt><tt class="py-op">)</tt> </tt>
</div><a name="L82"></a><tt class="py-lineno"> 82</tt>  <tt class="py-line">                 </tt>
<a name="Forensie.ExecuteCommand"></a><div id="Forensie.ExecuteCommand-def"><a name="L83"></a><tt class="py-lineno"> 83</tt> <a class="py-toggle" href="#" id="Forensie.ExecuteCommand-toggle" onclick="return toggle('Forensie.ExecuteCommand');">-</a><tt class="py-line">        <tt class="py-keyword">def</tt> <a class="py-def-name" href="Forensie.Forensie-class.html#ExecuteCommand">ExecuteCommand</a><tt class="py-op">(</tt><tt class="py-param">self</tt><tt class="py-op">)</tt><tt class="py-op">:</tt> </tt>
</div><div id="Forensie.ExecuteCommand-collapsed" style="display:none;" pad="+++" indent="++++++++++++"></div><div id="Forensie.ExecuteCommand-expanded"><a name="L84"></a><tt class="py-lineno"> 84</tt>  <tt class="py-line">                <tt class="py-docstring">"""Processes the input text according to the stored command(s). Calls </tt> </tt>
<a name="L85"></a><tt class="py-lineno"> 85</tt>  <tt class="py-line"><tt class="py-docstring">                the method corresponding to the first command given. Raises a </tt> </tt>
<a name="L86"></a><tt class="py-lineno"> 86</tt>  <tt class="py-line"><tt class="py-docstring">                FormatError if no valid command is found. If called from </tt> </tt>
<a name="L87"></a><tt class="py-lineno"> 87</tt>  <tt class="py-line"><tt class="py-docstring">                ProcessInput(), this will cause the text to be processed as plain </tt> </tt>
<a name="L88"></a><tt class="py-lineno"> 88</tt>  <tt class="py-line"><tt class="py-docstring">                hex.</tt> </tt>
<a name="L89"></a><tt class="py-lineno"> 89</tt>  <tt class="py-line"><tt class="py-docstring">                </tt> </tt>
<a name="L90"></a><tt class="py-lineno"> 90</tt>  <tt class="py-line"><tt class="py-docstring">                Returns the value returned from whichever method is called.</tt> </tt>
<a name="L91"></a><tt class="py-lineno"> 91</tt>  <tt class="py-line"><tt class="py-docstring">                """</tt> </tt>
<a name="L92"></a><tt class="py-lineno"> 92</tt>  <tt class="py-line">                <tt class="py-comment"># Process according to first given command</tt> </tt>
<a name="L93"></a><tt class="py-lineno"> 93</tt>  <tt class="py-line">                <tt class="py-keyword">try</tt><tt class="py-op">:</tt> </tt>
<a name="L94"></a><tt class="py-lineno"> 94</tt>  <tt class="py-line">                        <tt class="py-name">com</tt> <tt class="py-op">=</tt> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">commands</tt><tt class="py-op">[</tt><tt class="py-number">0</tt><tt class="py-op">]</tt> </tt>
<a name="L95"></a><tt class="py-lineno"> 95</tt>  <tt class="py-line">                <tt class="py-keyword">except</tt> <tt class="py-name">IndexError</tt><tt class="py-op">:</tt> <tt class="py-comment"># No command found</tt> </tt>
<a name="L96"></a><tt class="py-lineno"> 96</tt>  <tt class="py-line">                        <tt class="py-keyword">raise</tt> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt id="link-12" class="py-name"><a title="Forensie.Forensie.FormatError" class="py-name" href="#" onclick="return doclink('link-12', 'FormatError', 'link-9');">FormatError</a></tt><tt class="py-op">(</tt><tt class="py-string">'No command found.'</tt><tt class="py-op">)</tt> </tt>
<a name="L97"></a><tt class="py-lineno"> 97</tt>  <tt class="py-line">                <tt class="py-keyword">except</tt> <tt class="py-name">AttributeError</tt><tt class="py-op">:</tt> <tt class="py-comment"># No command found</tt> </tt>
<a name="L98"></a><tt class="py-lineno"> 98</tt>  <tt class="py-line">                        <tt class="py-keyword">raise</tt> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt id="link-13" class="py-name"><a title="Forensie.Forensie.FormatError" class="py-name" href="#" onclick="return doclink('link-13', 'FormatError', 'link-9');">FormatError</a></tt><tt class="py-op">(</tt><tt class="py-string">'No command found.'</tt><tt class="py-op">)</tt> </tt>
<a name="L99"></a><tt class="py-lineno"> 99</tt>  <tt class="py-line">                 </tt>
<a name="L100"></a><tt class="py-lineno">100</tt>  <tt class="py-line">                <tt class="py-keyword">if</tt> <tt class="py-string">'little-endian'</tt> <tt class="py-keyword">in</tt> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">commands</tt><tt class="py-op">:</tt> </tt>
<a name="L101"></a><tt class="py-lineno">101</tt>  <tt class="py-line">                        <tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">endian</tt> <tt class="py-op">=</tt> <tt class="py-string">'little'</tt> </tt>
<a name="L102"></a><tt class="py-lineno">102</tt>  <tt class="py-line">                <tt class="py-keyword">elif</tt> <tt class="py-string">'big-endian'</tt> <tt class="py-keyword">in</tt> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">commands</tt><tt class="py-op">:</tt> </tt>
<a name="L103"></a><tt class="py-lineno">103</tt>  <tt class="py-line">                        <tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">endian</tt> <tt class="py-op">=</tt> <tt class="py-string">'big'</tt> </tt>
<a name="L104"></a><tt class="py-lineno">104</tt>  <tt class="py-line">                 </tt>
<a name="L105"></a><tt class="py-lineno">105</tt>  <tt class="py-line">                <tt class="py-keyword">if</tt> <tt class="py-name">com</tt> <tt class="py-op">==</tt> <tt class="py-string">'mbr'</tt><tt class="py-op">:</tt> </tt>
<a name="L106"></a><tt class="py-lineno">106</tt>  <tt class="py-line">                        <tt class="py-keyword">return</tt> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt id="link-14" class="py-name" targets="Method Forensie.Forensie.MBRdetector()=Forensie.Forensie-class.html#MBRdetector"><a title="Forensie.Forensie.MBRdetector" class="py-name" href="#" onclick="return doclink('link-14', 'MBRdetector', 'link-14');">MBRdetector</a></tt><tt class="py-op">(</tt><tt class="py-op">)</tt> </tt>
<a name="L107"></a><tt class="py-lineno">107</tt>  <tt class="py-line">                 </tt>
<a name="L108"></a><tt class="py-lineno">108</tt>  <tt class="py-line">                <tt class="py-keyword">elif</tt> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">commands</tt><tt class="py-op">[</tt><tt class="py-number">0</tt><tt class="py-op">]</tt> <tt class="py-op">==</tt> <tt class="py-string">'fat-vbr'</tt><tt class="py-op">:</tt> </tt>
<a name="L109"></a><tt class="py-lineno">109</tt>  <tt class="py-line">                        <tt class="py-keyword">return</tt> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt id="link-15" class="py-name" targets="Method Forensie.Forensie.FATVBRdetector()=Forensie.Forensie-class.html#FATVBRdetector"><a title="Forensie.Forensie.FATVBRdetector" class="py-name" href="#" onclick="return doclink('link-15', 'FATVBRdetector', 'link-15');">FATVBRdetector</a></tt><tt class="py-op">(</tt><tt class="py-op">)</tt> </tt>
<a name="L110"></a><tt class="py-lineno">110</tt>  <tt class="py-line">                 </tt>
<a name="L111"></a><tt class="py-lineno">111</tt>  <tt class="py-line">                <tt class="py-keyword">elif</tt> <tt class="py-name">com</tt> <tt class="py-op">==</tt> <tt class="py-string">'date'</tt><tt class="py-op">:</tt> </tt>
<a name="L112"></a><tt class="py-lineno">112</tt>  <tt class="py-line">                        <tt class="py-comment">#if 'fat' in self.commands:</tt> </tt>
<a name="L113"></a><tt class="py-lineno">113</tt>  <tt class="py-line">                        <tt class="py-keyword">return</tt> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt id="link-16" class="py-name" targets="Method Forensie.Forensie.DateDetector()=Forensie.Forensie-class.html#DateDetector"><a title="Forensie.Forensie.DateDetector" class="py-name" href="#" onclick="return doclink('link-16', 'DateDetector', 'link-16');">DateDetector</a></tt><tt class="py-op">(</tt><tt class="py-op">)</tt> </tt>
<a name="L114"></a><tt class="py-lineno">114</tt>  <tt class="py-line">                 </tt>
<a name="L115"></a><tt class="py-lineno">115</tt>  <tt class="py-line">                <tt class="py-keyword">elif</tt> <tt class="py-name">com</tt> <tt class="py-op">==</tt> <tt class="py-string">'time'</tt><tt class="py-op">:</tt> </tt>
<a name="L116"></a><tt class="py-lineno">116</tt>  <tt class="py-line">                        <tt class="py-keyword">return</tt> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt id="link-17" class="py-name" targets="Method Forensie.Forensie.TimeDetector()=Forensie.Forensie-class.html#TimeDetector"><a title="Forensie.Forensie.TimeDetector" class="py-name" href="#" onclick="return doclink('link-17', 'TimeDetector', 'link-17');">TimeDetector</a></tt><tt class="py-op">(</tt><tt class="py-op">)</tt> </tt>
<a name="L117"></a><tt class="py-lineno">117</tt>  <tt class="py-line">                 </tt>
<a name="L118"></a><tt class="py-lineno">118</tt>  <tt class="py-line">                <tt class="py-keyword">elif</tt> <tt class="py-name">com</tt> <tt class="py-op">==</tt> <tt class="py-string">'datetime'</tt><tt class="py-op">:</tt> </tt>
<a name="L119"></a><tt class="py-lineno">119</tt>  <tt class="py-line">                        <tt class="py-keyword">return</tt> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt id="link-18" class="py-name" targets="Method Forensie.Forensie.DateTimeDetector()=Forensie.Forensie-class.html#DateTimeDetector"><a title="Forensie.Forensie.DateTimeDetector" class="py-name" href="#" onclick="return doclink('link-18', 'DateTimeDetector', 'link-18');">DateTimeDetector</a></tt><tt class="py-op">(</tt><tt class="py-op">)</tt> </tt>
<a name="L120"></a><tt class="py-lineno">120</tt>  <tt class="py-line">                 </tt>
<a name="L121"></a><tt class="py-lineno">121</tt>  <tt class="py-line">                <tt class="py-keyword">elif</tt> <tt class="py-name">com</tt> <tt class="py-op">==</tt> <tt class="py-string">'hex'</tt><tt class="py-op">:</tt> </tt>
<a name="L122"></a><tt class="py-lineno">122</tt>  <tt class="py-line">                        <tt class="py-keyword">return</tt> <tt class="py-op">(</tt><tt class="py-name">self</tt><tt class="py-op">.</tt><tt id="link-19" class="py-name"><a title="Forensie.Forensie.DecodeHex" class="py-name" href="#" onclick="return doclink('link-19', 'DecodeHex', 'link-11');">DecodeHex</a></tt><tt class="py-op">(</tt><tt class="py-op">)</tt><tt class="py-op">,</tt> <tt class="py-string">'success'</tt><tt class="py-op">,</tt> <tt class="py-string">'hex'</tt><tt class="py-op">)</tt> </tt>
<a name="L123"></a><tt class="py-lineno">123</tt>  <tt class="py-line">                 </tt>
<a name="L124"></a><tt class="py-lineno">124</tt>  <tt class="py-line">                <tt class="py-keyword">else</tt><tt class="py-op">:</tt> <tt class="py-keyword">raise</tt> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt id="link-20" class="py-name"><a title="Forensie.Forensie.FormatError" class="py-name" href="#" onclick="return doclink('link-20', 'FormatError', 'link-9');">FormatError</a></tt><tt class="py-op">(</tt><tt class="py-string">'An unsupported command passed through: %s'</tt> <tt class="py-op">%</tt> <tt class="py-name">com</tt><tt class="py-op">)</tt> </tt>
</div><a name="L125"></a><tt class="py-lineno">125</tt>  <tt class="py-line">         </tt>
<a name="Forensie.MBRdetector"></a><div id="Forensie.MBRdetector-def"><a name="L126"></a><tt class="py-lineno">126</tt> <a class="py-toggle" href="#" id="Forensie.MBRdetector-toggle" onclick="return toggle('Forensie.MBRdetector');">-</a><tt class="py-line">        <tt class="py-keyword">def</tt> <a class="py-def-name" href="Forensie.Forensie-class.html#MBRdetector">MBRdetector</a><tt class="py-op">(</tt><tt class="py-param">self</tt><tt class="py-op">)</tt><tt class="py-op">:</tt> </tt>
</div><div id="Forensie.MBRdetector-collapsed" style="display:none;" pad="+++" indent="++++++++++++"></div><div id="Forensie.MBRdetector-expanded"><a name="L127"></a><tt class="py-lineno">127</tt>  <tt class="py-line">                <tt class="py-docstring">"""Entry point for interpreting the input as an MBR. Begins processing </tt> </tt>
<a name="L128"></a><tt class="py-lineno">128</tt>  <tt class="py-line"><tt class="py-docstring">                the input text and determines if the length and boot signature are </tt> </tt>
<a name="L129"></a><tt class="py-lineno">129</tt>  <tt class="py-line"><tt class="py-docstring">                valid before proceeding. Splits the four primary partition tables </tt> </tt>
<a name="L130"></a><tt class="py-lineno">130</tt>  <tt class="py-line"><tt class="py-docstring">                and sends them each to GetPartInfo(). The information from these </tt> </tt>
<a name="L131"></a><tt class="py-lineno">131</tt>  <tt class="py-line"><tt class="py-docstring">                four entries together make up the bulk of the valuable information </tt> </tt>
<a name="L132"></a><tt class="py-lineno">132</tt>  <tt class="py-line"><tt class="py-docstring">                in an MBR, so it is sent directly to FormatPartInfo().</tt> </tt>
<a name="L133"></a><tt class="py-lineno">133</tt>  <tt class="py-line"><tt class="py-docstring">                </tt> </tt>
<a name="L134"></a><tt class="py-lineno">134</tt>  <tt class="py-line"><tt class="py-docstring">                Returns a regular success tuple (see ProcessInput()).</tt> </tt>
<a name="L135"></a><tt class="py-lineno">135</tt>  <tt class="py-line"><tt class="py-docstring">                """</tt> </tt>
<a name="L136"></a><tt class="py-lineno">136</tt>  <tt class="py-line">                <tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">bytes</tt> <tt class="py-op">=</tt> <tt id="link-21" class="py-name" targets="Function Forensie.ChopHexStr()=Forensie-module.html#ChopHexStr"><a title="Forensie.ChopHexStr" class="py-name" href="#" onclick="return doclink('link-21', 'ChopHexStr', 'link-21');">ChopHexStr</a></tt><tt class="py-op">(</tt><tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">inputStr</tt><tt class="py-op">)</tt> </tt>
<a name="L137"></a><tt class="py-lineno">137</tt>  <tt class="py-line">                 </tt>
<a name="L138"></a><tt class="py-lineno">138</tt>  <tt class="py-line">                <tt class="py-comment"># Check length of string</tt> </tt>
<a name="L139"></a><tt class="py-lineno">139</tt>  <tt class="py-line">                <tt class="py-keyword">if</tt> <tt class="py-name">len</tt><tt class="py-op">(</tt><tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">bytes</tt><tt class="py-op">)</tt> <tt class="py-op">!=</tt> <tt class="py-number">512</tt><tt class="py-op">:</tt> </tt>
<a name="L140"></a><tt class="py-lineno">140</tt>  <tt class="py-line">                        <tt class="py-keyword">raise</tt> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt id="link-22" class="py-name"><a title="Forensie.Forensie.FormatError" class="py-name" href="#" onclick="return doclink('link-22', 'FormatError', 'link-9');">FormatError</a></tt><tt class="py-op">(</tt><tt class="py-string">'MBR is of improper length: %d, expected 512'</tt> <tt class="py-op">%</tt> <tt class="py-name">len</tt><tt class="py-op">(</tt><tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">bytes</tt><tt class="py-op">)</tt><tt class="py-op">)</tt> </tt>
<a name="L141"></a><tt class="py-lineno">141</tt>  <tt class="py-line">                 </tt>
<a name="L142"></a><tt class="py-lineno">142</tt>  <tt class="py-line">                <tt class="py-comment"># Determine Endian</tt> </tt>
<a name="L143"></a><tt class="py-lineno">143</tt>  <tt class="py-line">                <tt class="py-keyword">if</tt> <tt class="py-op">[</tt><tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">bytes</tt><tt class="py-op">[</tt><tt class="py-op">-</tt><tt class="py-number">2</tt><tt class="py-op">]</tt><tt class="py-op">,</tt> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">bytes</tt><tt class="py-op">[</tt><tt class="py-op">-</tt><tt class="py-number">1</tt><tt class="py-op">]</tt><tt class="py-op">.</tt><tt class="py-name">upper</tt><tt class="py-op">(</tt><tt class="py-op">)</tt><tt class="py-op">]</tt> <tt class="py-op">==</tt> <tt class="py-op">[</tt><tt class="py-string">'55'</tt><tt class="py-op">,</tt> <tt class="py-string">'AA'</tt><tt class="py-op">]</tt><tt class="py-op">:</tt> </tt>
<a name="L144"></a><tt class="py-lineno">144</tt>  <tt class="py-line">                        <tt class="py-comment"># Little Endian</tt> </tt>
<a name="L145"></a><tt class="py-lineno">145</tt>  <tt class="py-line">                        <tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">endian</tt> <tt class="py-op">=</tt> <tt class="py-string">'little'</tt> </tt>
<a name="L146"></a><tt class="py-lineno">146</tt>  <tt class="py-line">                <tt class="py-keyword">elif</tt> <tt class="py-op">[</tt><tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">bytes</tt><tt class="py-op">[</tt><tt class="py-op">-</tt><tt class="py-number">2</tt><tt class="py-op">]</tt><tt class="py-op">.</tt><tt class="py-name">upper</tt><tt class="py-op">(</tt><tt class="py-op">)</tt><tt class="py-op">,</tt> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">bytes</tt><tt class="py-op">[</tt><tt class="py-op">-</tt><tt class="py-number">1</tt><tt class="py-op">]</tt><tt class="py-op">]</tt> <tt class="py-op">==</tt> <tt class="py-op">[</tt><tt class="py-string">'AA'</tt><tt class="py-op">,</tt> <tt class="py-string">'55'</tt><tt class="py-op">]</tt><tt class="py-op">:</tt> </tt>
<a name="L147"></a><tt class="py-lineno">147</tt>  <tt class="py-line">                        <tt class="py-comment"># Big Endian</tt> </tt>
<a name="L148"></a><tt class="py-lineno">148</tt>  <tt class="py-line">                        <tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">endian</tt> <tt class="py-op">=</tt> <tt class="py-string">'big'</tt> </tt>
<a name="L149"></a><tt class="py-lineno">149</tt>  <tt class="py-line">                <tt class="py-keyword">else</tt><tt class="py-op">:</tt> </tt>
<a name="L150"></a><tt class="py-lineno">150</tt>  <tt class="py-line">                        <tt class="py-comment">#print 'MBR does not have a valid signature'</tt> </tt>
<a name="L151"></a><tt class="py-lineno">151</tt>  <tt class="py-line">                        <tt class="py-keyword">raise</tt> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt id="link-23" class="py-name"><a title="Forensie.Forensie.FormatError" class="py-name" href="#" onclick="return doclink('link-23', 'FormatError', 'link-9');">FormatError</a></tt><tt class="py-op">(</tt><tt class="py-string">'MBR does not have a valid signature.'</tt><tt class="py-op">)</tt> </tt>
<a name="L152"></a><tt class="py-lineno">152</tt>  <tt class="py-line">                 </tt>
<a name="L153"></a><tt class="py-lineno">153</tt>  <tt class="py-line">                <tt class="py-name">partitionsInfo</tt> <tt class="py-op">=</tt> <tt class="py-op">[</tt><tt class="py-op">]</tt> </tt>
<a name="L154"></a><tt class="py-lineno">154</tt>  <tt class="py-line">                <tt class="py-keyword">for</tt> <tt class="py-name">n</tt> <tt class="py-keyword">in</tt> <tt class="py-name">range</tt><tt class="py-op">(</tt><tt class="py-number">4</tt><tt class="py-op">)</tt><tt class="py-op">:</tt> </tt>
<a name="L155"></a><tt class="py-lineno">155</tt>  <tt class="py-line">                        <tt class="py-name">offset</tt> <tt class="py-op">=</tt> <tt class="py-number">446</tt><tt class="py-op">+</tt><tt class="py-number">16</tt><tt class="py-op">*</tt><tt class="py-name">n</tt> <tt class="py-comment"># Boot code length + offset of the partitions already parsed</tt> </tt>
<a name="L156"></a><tt class="py-lineno">156</tt>  <tt class="py-line">                        <tt class="py-name">partEntry</tt> <tt class="py-op">=</tt> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">bytes</tt><tt class="py-op">[</tt><tt class="py-name">offset</tt><tt class="py-op">:</tt><tt class="py-name">offset</tt><tt class="py-op">+</tt><tt class="py-number">16</tt><tt class="py-op">]</tt> </tt>
<a name="L157"></a><tt class="py-lineno">157</tt>  <tt class="py-line">                        <tt class="py-name">partitionsInfo</tt> <tt class="py-op">+=</tt> <tt class="py-op">[</tt><tt class="py-name">self</tt><tt class="py-op">.</tt><tt id="link-24" class="py-name" targets="Method Forensie.Forensie.GetPartInfo()=Forensie.Forensie-class.html#GetPartInfo"><a title="Forensie.Forensie.GetPartInfo" class="py-name" href="#" onclick="return doclink('link-24', 'GetPartInfo', 'link-24');">GetPartInfo</a></tt><tt class="py-op">(</tt><tt class="py-name">partEntry</tt><tt class="py-op">)</tt><tt class="py-op">]</tt> </tt>
<a name="L158"></a><tt class="py-lineno">158</tt>  <tt class="py-line">                 </tt>
<a name="L159"></a><tt class="py-lineno">159</tt>  <tt class="py-line">                <tt class="py-keyword">return</tt> <tt class="py-op">(</tt><tt class="py-name">self</tt><tt class="py-op">.</tt><tt id="link-25" class="py-name" targets="Method Forensie.Forensie.FormatPartInfo()=Forensie.Forensie-class.html#FormatPartInfo"><a title="Forensie.Forensie.FormatPartInfo" class="py-name" href="#" onclick="return doclink('link-25', 'FormatPartInfo', 'link-25');">FormatPartInfo</a></tt><tt class="py-op">(</tt><tt class="py-name">partitionsInfo</tt><tt class="py-op">)</tt><tt class="py-op">,</tt> <tt class="py-string">'success'</tt><tt class="py-op">,</tt> <tt class="py-string">'mbr'</tt><tt class="py-op">)</tt> </tt>
</div><a name="L160"></a><tt class="py-lineno">160</tt>  <tt class="py-line">         </tt>
<a name="Forensie.DateDetector"></a><div id="Forensie.DateDetector-def"><a name="L161"></a><tt class="py-lineno">161</tt> <a class="py-toggle" href="#" id="Forensie.DateDetector-toggle" onclick="return toggle('Forensie.DateDetector');">-</a><tt class="py-line">        <tt class="py-keyword">def</tt> <a class="py-def-name" href="Forensie.Forensie-class.html#DateDetector">DateDetector</a><tt class="py-op">(</tt><tt class="py-param">self</tt><tt class="py-op">,</tt> <tt class="py-param">alt</tt><tt class="py-op">=</tt><tt class="py-name">None</tt><tt class="py-op">,</tt> <tt class="py-param">raw</tt><tt class="py-op">=</tt><tt class="py-name">False</tt><tt class="py-op">)</tt><tt class="py-op">:</tt> </tt>
</div><div id="Forensie.DateDetector-collapsed" style="display:none;" pad="+++" indent="++++++++++++"></div><div id="Forensie.DateDetector-expanded"><a name="L162"></a><tt class="py-lineno">162</tt>  <tt class="py-line">                <tt class="py-docstring">"""Detects and interprets an FAT date value. Alternate text can be </tt> </tt>
<a name="L163"></a><tt class="py-lineno">163</tt>  <tt class="py-line"><tt class="py-docstring">                passed to alt if the calling code needs text other than the input </tt> </tt>
<a name="L164"></a><tt class="py-lineno">164</tt>  <tt class="py-line"><tt class="py-docstring">                string to be processed. Also, if raw is True, the processing </tt> </tt>
<a name="L165"></a><tt class="py-lineno">165</tt>  <tt class="py-line"><tt class="py-docstring">                results are not put into a string or the success tuple before being </tt> </tt>
<a name="L166"></a><tt class="py-lineno">166</tt>  <tt class="py-line"><tt class="py-docstring">                returned.</tt> </tt>
<a name="L167"></a><tt class="py-lineno">167</tt>  <tt class="py-line"><tt class="py-docstring">                </tt> </tt>
<a name="L168"></a><tt class="py-lineno">168</tt>  <tt class="py-line"><tt class="py-docstring">                Returns a regular success tuple (see ProcessInput()).</tt> </tt>
<a name="L169"></a><tt class="py-lineno">169</tt>  <tt class="py-line"><tt class="py-docstring">                """</tt> </tt>
<a name="L170"></a><tt class="py-lineno">170</tt>  <tt class="py-line">                <tt class="py-keyword">if</tt> <tt class="py-name">alt</tt> <tt class="py-op">==</tt> <tt class="py-name">None</tt><tt class="py-op">:</tt> <tt class="py-name">alt</tt> <tt class="py-op">=</tt> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">inputStr</tt> </tt>
<a name="L171"></a><tt class="py-lineno">171</tt>  <tt class="py-line">                <tt class="py-keyword">if</tt> <tt class="py-name">len</tt><tt class="py-op">(</tt><tt class="py-name">alt</tt><tt class="py-op">)</tt> <tt class="py-op">!=</tt> <tt class="py-number">4</tt><tt class="py-op">:</tt> <tt class="py-keyword">raise</tt> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt id="link-26" class="py-name"><a title="Forensie.Forensie.FormatError" class="py-name" href="#" onclick="return doclink('link-26', 'FormatError', 'link-9');">FormatError</a></tt><tt class="py-op">(</tt><tt class="py-string">'Date value has improper length of %d, expected 4'</tt> <tt class="py-op">%</tt> <tt class="py-name">len</tt><tt class="py-op">(</tt><tt class="py-name">alt</tt><tt class="py-op">)</tt><tt class="py-op">)</tt> </tt>
<a name="L172"></a><tt class="py-lineno">172</tt>  <tt class="py-line">                <tt class="py-name">result</tt> <tt class="py-op">=</tt> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt id="link-27" class="py-name" targets="Method Forensie.Forensie.GetDate()=Forensie.Forensie-class.html#GetDate"><a title="Forensie.Forensie.GetDate" class="py-name" href="#" onclick="return doclink('link-27', 'GetDate', 'link-27');">GetDate</a></tt><tt class="py-op">(</tt><tt id="link-28" class="py-name" targets="Function Forensie.Hex2Dec()=Forensie-module.html#Hex2Dec"><a title="Forensie.Hex2Dec" class="py-name" href="#" onclick="return doclink('link-28', 'Hex2Dec', 'link-28');">Hex2Dec</a></tt><tt class="py-op">(</tt><tt class="py-name">alt</tt><tt class="py-op">,</tt> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">endian</tt><tt class="py-op">)</tt><tt class="py-op">)</tt> </tt>
<a name="L173"></a><tt class="py-lineno">173</tt>  <tt class="py-line">                <tt class="py-keyword">if</tt> <tt class="py-name">raw</tt><tt class="py-op">:</tt> <tt class="py-keyword">return</tt> <tt class="py-name">result</tt> <tt class="py-comment"># Unformatted (raw) results requested</tt> </tt>
<a name="L174"></a><tt class="py-lineno">174</tt>  <tt class="py-line">                <tt class="py-keyword">return</tt> <tt class="py-op">(</tt><tt class="py-string">'Date Value: %d %s, %d\nProcessed for %s endian format'</tt> <tt class="py-op">%</tt> <tt class="py-op">(</tt><tt class="py-name">result</tt><tt class="py-op">+</tt><tt class="py-op">(</tt><tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">endian</tt><tt class="py-op">,</tt><tt class="py-op">)</tt><tt class="py-op">)</tt><tt class="py-op">,</tt> <tt class="py-string">'success'</tt><tt class="py-op">,</tt> <tt class="py-string">'date'</tt><tt class="py-op">)</tt> </tt>
</div><a name="L175"></a><tt class="py-lineno">175</tt>  <tt class="py-line">         </tt>
<a name="Forensie.GetDate"></a><div id="Forensie.GetDate-def"><a name="L176"></a><tt class="py-lineno">176</tt> <a class="py-toggle" href="#" id="Forensie.GetDate-toggle" onclick="return toggle('Forensie.GetDate');">-</a><tt class="py-line">        <tt class="py-keyword">def</tt> <a class="py-def-name" href="Forensie.Forensie-class.html#GetDate">GetDate</a><tt class="py-op">(</tt><tt class="py-param">self</tt><tt class="py-op">,</tt> <tt class="py-param">dateNum</tt><tt class="py-op">)</tt><tt class="py-op">:</tt> </tt>
</div><div id="Forensie.GetDate-collapsed" style="display:none;" pad="+++" indent="++++++++++++"></div><div id="Forensie.GetDate-expanded"><a name="L177"></a><tt class="py-lineno">177</tt>  <tt class="py-line">                <tt class="py-docstring">"""Performs the calculation necessary for converting a given dateNum </tt> </tt>
<a name="L178"></a><tt class="py-lineno">178</tt>  <tt class="py-line"><tt class="py-docstring">                value to a tuple in the format (day, month name, year). Raises </tt> </tt>
<a name="L179"></a><tt class="py-lineno">179</tt>  <tt class="py-line"><tt class="py-docstring">                self.FormatError on any invalid values.</tt> </tt>
<a name="L180"></a><tt class="py-lineno">180</tt>  <tt class="py-line"><tt class="py-docstring">                """</tt> </tt>
<a name="L181"></a><tt class="py-lineno">181</tt>  <tt class="py-line">                <tt class="py-keyword">if</tt> <tt class="py-name">type</tt><tt class="py-op">(</tt><tt class="py-name">dateNum</tt><tt class="py-op">)</tt> <tt class="py-op">!=</tt> <tt class="py-name">int</tt><tt class="py-op">:</tt> </tt>
<a name="L182"></a><tt class="py-lineno">182</tt>  <tt class="py-line">                        <tt class="py-keyword">raise</tt> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt id="link-29" class="py-name"><a title="Forensie.Forensie.FormatError" class="py-name" href="#" onclick="return doclink('link-29', 'FormatError', 'link-9');">FormatError</a></tt><tt class="py-op">(</tt><tt class="py-string">"While converting a date value, received unexpected input type: %s, expected 'int'"</tt> <tt class="py-op">%</tt><tt class="py-name">type</tt><tt class="py-op">(</tt><tt class="py-name">dateNum</tt><tt class="py-op">)</tt><tt class="py-op">)</tt> </tt>
<a name="L183"></a><tt class="py-lineno">183</tt>  <tt class="py-line">                <tt class="py-name">day</tt> <tt class="py-op">=</tt> <tt class="py-name">dateNum</tt> <tt class="py-op">&amp;</tt> <tt class="py-name">int</tt><tt class="py-op">(</tt><tt class="py-string">'11111'</tt><tt class="py-op">,</tt> <tt class="py-number">2</tt><tt class="py-op">)</tt> </tt>
<a name="L184"></a><tt class="py-lineno">184</tt>  <tt class="py-line">                <tt class="py-name">month</tt> <tt class="py-op">=</tt> <tt class="py-op">(</tt><tt class="py-name">dateNum</tt> <tt class="py-op">&amp;</tt> <tt class="py-name">int</tt><tt class="py-op">(</tt><tt class="py-string">'111100000'</tt><tt class="py-op">,</tt> <tt class="py-number">2</tt><tt class="py-op">)</tt><tt class="py-op">)</tt> <tt class="py-op">&gt;&gt;</tt> <tt class="py-number">5</tt> </tt>
<a name="L185"></a><tt class="py-lineno">185</tt>  <tt class="py-line">                <tt class="py-name">year</tt> <tt class="py-op">=</tt> <tt class="py-op">(</tt><tt class="py-name">dateNum</tt> <tt class="py-op">&gt;&gt;</tt> <tt class="py-number">9</tt><tt class="py-op">)</tt> <tt class="py-op">+</tt> <tt class="py-number">1980</tt> </tt>
<a name="L186"></a><tt class="py-lineno">186</tt>  <tt class="py-line">                <tt class="py-name">months</tt> <tt class="py-op">=</tt> <tt class="py-op">[</tt><tt class="py-name">None</tt><tt class="py-op">,</tt> <tt class="py-string">'January'</tt><tt class="py-op">,</tt> <tt class="py-string">'February'</tt><tt class="py-op">,</tt> <tt class="py-string">'March'</tt><tt class="py-op">,</tt> <tt class="py-string">'April'</tt><tt class="py-op">,</tt> <tt class="py-string">'May'</tt><tt class="py-op">,</tt> <tt class="py-string">'June'</tt><tt class="py-op">,</tt> <tt class="py-string">'July'</tt><tt class="py-op">,</tt> <tt class="py-string">'August'</tt><tt class="py-op">,</tt> <tt class="py-string">'September'</tt><tt class="py-op">,</tt> <tt class="py-string">'October'</tt><tt class="py-op">,</tt> <tt class="py-string">'November'</tt><tt class="py-op">,</tt> <tt class="py-string">'December'</tt><tt class="py-op">]</tt> </tt>
<a name="L187"></a><tt class="py-lineno">187</tt>  <tt class="py-line">                 </tt>
<a name="L188"></a><tt class="py-lineno">188</tt>  <tt class="py-line">                <tt class="py-keyword">if</tt> <tt class="py-keyword">not</tt> <tt class="py-op">(</tt><tt class="py-name">day</tt> <tt class="py-keyword">and</tt> <tt class="py-name">month</tt><tt class="py-op">)</tt><tt class="py-op">:</tt> </tt>
<a name="L189"></a><tt class="py-lineno">189</tt>  <tt class="py-line">                        <tt class="py-keyword">raise</tt> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt id="link-30" class="py-name"><a title="Forensie.Forensie.FormatError" class="py-name" href="#" onclick="return doclink('link-30', 'FormatError', 'link-9');">FormatError</a></tt><tt class="py-op">(</tt><tt class="py-string">'Invalid day or month value of 0 in number: %d'</tt> <tt class="py-op">%</tt> <tt class="py-name">dateNum</tt><tt class="py-op">)</tt> </tt>
<a name="L190"></a><tt class="py-lineno">190</tt>  <tt class="py-line">                 </tt>
<a name="L191"></a><tt class="py-lineno">191</tt>  <tt class="py-line">                <tt class="py-keyword">try</tt><tt class="py-op">:</tt> </tt>
<a name="L192"></a><tt class="py-lineno">192</tt>  <tt class="py-line">                        <tt class="py-keyword">return</tt> <tt class="py-op">(</tt><tt class="py-name">day</tt><tt class="py-op">,</tt> <tt class="py-name">months</tt><tt class="py-op">[</tt><tt class="py-name">month</tt><tt class="py-op">]</tt><tt class="py-op">,</tt> <tt class="py-name">year</tt><tt class="py-op">)</tt> </tt>
<a name="L193"></a><tt class="py-lineno">193</tt>  <tt class="py-line">                <tt class="py-keyword">except</tt> <tt class="py-name">IndexError</tt><tt class="py-op">:</tt> <tt class="py-comment"># Indexed a month &gt; 12</tt> </tt>
<a name="L194"></a><tt class="py-lineno">194</tt>  <tt class="py-line">                        <tt class="py-keyword">raise</tt> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt id="link-31" class="py-name"><a title="Forensie.Forensie.FormatError" class="py-name" href="#" onclick="return doclink('link-31', 'FormatError', 'link-9');">FormatError</a></tt><tt class="py-op">(</tt><tt class="py-string">'Month value in date number %d is greater than 12: %d'</tt> <tt class="py-op">%</tt> <tt class="py-op">(</tt><tt class="py-name">dateNum</tt><tt class="py-op">,</tt> <tt class="py-name">month</tt><tt class="py-op">)</tt><tt class="py-op">)</tt> </tt>
</div><a name="L195"></a><tt class="py-lineno">195</tt>  <tt class="py-line">         </tt>
<a name="Forensie.TimeDetector"></a><div id="Forensie.TimeDetector-def"><a name="L196"></a><tt class="py-lineno">196</tt> <a class="py-toggle" href="#" id="Forensie.TimeDetector-toggle" onclick="return toggle('Forensie.TimeDetector');">-</a><tt class="py-line">        <tt class="py-keyword">def</tt> <a class="py-def-name" href="Forensie.Forensie-class.html#TimeDetector">TimeDetector</a><tt class="py-op">(</tt><tt class="py-param">self</tt><tt class="py-op">,</tt> <tt class="py-param">alt</tt><tt class="py-op">=</tt><tt class="py-name">None</tt><tt class="py-op">,</tt> <tt class="py-param">raw</tt><tt class="py-op">=</tt><tt class="py-name">False</tt><tt class="py-op">)</tt><tt class="py-op">:</tt> </tt>
</div><div id="Forensie.TimeDetector-collapsed" style="display:none;" pad="+++" indent="++++++++++++"></div><div id="Forensie.TimeDetector-expanded"><a name="L197"></a><tt class="py-lineno">197</tt>  <tt class="py-line">                <tt class="py-docstring">"""Detects and interprets an FAT time value. Alternate text can be </tt> </tt>
<a name="L198"></a><tt class="py-lineno">198</tt>  <tt class="py-line"><tt class="py-docstring">                passed to alt if the calling code needs text other than the input </tt> </tt>
<a name="L199"></a><tt class="py-lineno">199</tt>  <tt class="py-line"><tt class="py-docstring">                string to be processed. Also, if raw is True, the processing </tt> </tt>
<a name="L200"></a><tt class="py-lineno">200</tt>  <tt class="py-line"><tt class="py-docstring">                results are not put into a string or the success tuple before being </tt> </tt>
<a name="L201"></a><tt class="py-lineno">201</tt>  <tt class="py-line"><tt class="py-docstring">                returned. If the time value includes 100ths of seconds, these are </tt> </tt>
<a name="L202"></a><tt class="py-lineno">202</tt>  <tt class="py-line"><tt class="py-docstring">                added to the values sent to GetTime().</tt> </tt>
<a name="L203"></a><tt class="py-lineno">203</tt>  <tt class="py-line"><tt class="py-docstring">                </tt> </tt>
<a name="L204"></a><tt class="py-lineno">204</tt>  <tt class="py-line"><tt class="py-docstring">                Returns a regular success tuple (see ProcessInput()).</tt> </tt>
<a name="L205"></a><tt class="py-lineno">205</tt>  <tt class="py-line"><tt class="py-docstring">                """</tt> </tt>
<a name="L206"></a><tt class="py-lineno">206</tt>  <tt class="py-line">                <tt class="py-keyword">if</tt> <tt class="py-name">alt</tt> <tt class="py-op">==</tt> <tt class="py-name">None</tt><tt class="py-op">:</tt> <tt class="py-name">alt</tt> <tt class="py-op">=</tt> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">inputStr</tt> </tt>
<a name="L207"></a><tt class="py-lineno">207</tt>  <tt class="py-line">                <tt class="py-name">msec</tt> <tt class="py-op">=</tt> <tt class="py-number">0.0</tt> </tt>
<a name="L208"></a><tt class="py-lineno">208</tt>  <tt class="py-line">                <tt class="py-name">off</tt> <tt class="py-op">=</tt> <tt class="py-number">0</tt> </tt>
<a name="L209"></a><tt class="py-lineno">209</tt>  <tt class="py-line">                <tt class="py-keyword">if</tt> <tt class="py-name">len</tt><tt class="py-op">(</tt><tt class="py-name">alt</tt><tt class="py-op">)</tt> <tt class="py-op">==</tt> <tt class="py-number">6</tt><tt class="py-op">:</tt> <tt class="py-comment"># Time includes microsecond units</tt> </tt>
<a name="L210"></a><tt class="py-lineno">210</tt>  <tt class="py-line">                        <tt class="py-name">msec</tt> <tt class="py-op">=</tt> <tt id="link-32" class="py-name"><a title="Forensie.Hex2Dec" class="py-name" href="#" onclick="return doclink('link-32', 'Hex2Dec', 'link-28');">Hex2Dec</a></tt><tt class="py-op">(</tt><tt class="py-name">alt</tt><tt class="py-op">[</tt><tt class="py-op">:</tt><tt class="py-number">2</tt><tt class="py-op">]</tt><tt class="py-op">,</tt> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">endian</tt><tt class="py-op">)</tt><tt class="py-op">/</tt><tt class="py-number">100.0</tt> </tt>
<a name="L211"></a><tt class="py-lineno">211</tt>  <tt class="py-line">                        <tt class="py-name">off</tt> <tt class="py-op">=</tt> <tt class="py-number">2</tt> </tt>
<a name="L212"></a><tt class="py-lineno">212</tt>  <tt class="py-line">                <tt class="py-keyword">elif</tt> <tt class="py-name">len</tt><tt class="py-op">(</tt><tt class="py-name">alt</tt><tt class="py-op">)</tt> <tt class="py-op">!=</tt> <tt class="py-number">4</tt><tt class="py-op">:</tt> <tt class="py-keyword">raise</tt> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt id="link-33" class="py-name"><a title="Forensie.Forensie.FormatError" class="py-name" href="#" onclick="return doclink('link-33', 'FormatError', 'link-9');">FormatError</a></tt><tt class="py-op">(</tt><tt class="py-string">'Time value has improper length of %d, expected 4 or 6'</tt> <tt class="py-op">%</tt> <tt class="py-name">len</tt><tt class="py-op">(</tt><tt class="py-name">alt</tt><tt class="py-op">)</tt><tt class="py-op">)</tt> </tt>
<a name="L213"></a><tt class="py-lineno">213</tt>  <tt class="py-line">                 </tt>
<a name="L214"></a><tt class="py-lineno">214</tt>  <tt class="py-line">                <tt class="py-name">result</tt> <tt class="py-op">=</tt> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt id="link-34" class="py-name" targets="Method Forensie.Forensie.GetTime()=Forensie.Forensie-class.html#GetTime"><a title="Forensie.Forensie.GetTime" class="py-name" href="#" onclick="return doclink('link-34', 'GetTime', 'link-34');">GetTime</a></tt><tt class="py-op">(</tt><tt id="link-35" class="py-name"><a title="Forensie.Hex2Dec" class="py-name" href="#" onclick="return doclink('link-35', 'Hex2Dec', 'link-28');">Hex2Dec</a></tt><tt class="py-op">(</tt><tt class="py-name">alt</tt><tt class="py-op">[</tt><tt class="py-name">off</tt><tt class="py-op">:</tt><tt class="py-op">]</tt><tt class="py-op">,</tt> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">endian</tt><tt class="py-op">)</tt><tt class="py-op">,</tt> <tt class="py-name">msec</tt><tt class="py-op">)</tt> </tt>
<a name="L215"></a><tt class="py-lineno">215</tt>  <tt class="py-line">                <tt class="py-keyword">if</tt> <tt class="py-name">raw</tt><tt class="py-op">:</tt> <tt class="py-keyword">return</tt> <tt class="py-name">result</tt> <tt class="py-comment"># Unformatted (raw) results requested</tt> </tt>
<a name="L216"></a><tt class="py-lineno">216</tt>  <tt class="py-line">                <tt class="py-keyword">return</tt> <tt class="py-op">(</tt><tt class="py-string">'Time Value: %02d:%02d:%05.2f\nProcessed for %s endian format'</tt> <tt class="py-op">%</tt> <tt class="py-op">(</tt><tt class="py-name">result</tt><tt class="py-op">+</tt><tt class="py-op">(</tt><tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">endian</tt><tt class="py-op">,</tt><tt class="py-op">)</tt><tt class="py-op">)</tt><tt class="py-op">,</tt> <tt class="py-string">'success'</tt><tt class="py-op">,</tt> <tt class="py-string">'time'</tt><tt class="py-op">)</tt> </tt>
</div><a name="L217"></a><tt class="py-lineno">217</tt>  <tt class="py-line">         </tt>
<a name="Forensie.GetTime"></a><div id="Forensie.GetTime-def"><a name="L218"></a><tt class="py-lineno">218</tt> <a class="py-toggle" href="#" id="Forensie.GetTime-toggle" onclick="return toggle('Forensie.GetTime');">-</a><tt class="py-line">        <tt class="py-keyword">def</tt> <a class="py-def-name" href="Forensie.Forensie-class.html#GetTime">GetTime</a><tt class="py-op">(</tt><tt class="py-param">self</tt><tt class="py-op">,</tt> <tt class="py-param">timeNum</tt><tt class="py-op">,</tt> <tt class="py-param">msec</tt><tt class="py-op">=</tt><tt class="py-number">0.0</tt><tt class="py-op">)</tt><tt class="py-op">:</tt> </tt>
</div><div id="Forensie.GetTime-collapsed" style="display:none;" pad="+++" indent="++++++++++++"></div><div id="Forensie.GetTime-expanded"><a name="L219"></a><tt class="py-lineno">219</tt>  <tt class="py-line">                <tt class="py-docstring">"""Performs the calculation necessary for converting a given timeNum </tt> </tt>
<a name="L220"></a><tt class="py-lineno">220</tt>  <tt class="py-line"><tt class="py-docstring">                value to a tuple in the format (hour, minutes, seconds). Raises </tt> </tt>
<a name="L221"></a><tt class="py-lineno">221</tt>  <tt class="py-line"><tt class="py-docstring">                self.FormatError on any invalid values.</tt> </tt>
<a name="L222"></a><tt class="py-lineno">222</tt>  <tt class="py-line"><tt class="py-docstring">                """</tt> </tt>
<a name="L223"></a><tt class="py-lineno">223</tt>  <tt class="py-line">                <tt class="py-keyword">if</tt> <tt class="py-name">type</tt><tt class="py-op">(</tt><tt class="py-name">timeNum</tt><tt class="py-op">)</tt> <tt class="py-op">!=</tt> <tt class="py-name">int</tt><tt class="py-op">:</tt> </tt>
<a name="L224"></a><tt class="py-lineno">224</tt>  <tt class="py-line">                        <tt class="py-keyword">raise</tt> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt id="link-36" class="py-name"><a title="Forensie.Forensie.FormatError" class="py-name" href="#" onclick="return doclink('link-36', 'FormatError', 'link-9');">FormatError</a></tt><tt class="py-op">(</tt><tt class="py-string">'While converting a time value, received unexpected input type: %s'</tt><tt class="py-op">%</tt><tt class="py-name">type</tt><tt class="py-op">(</tt><tt class="py-name">timeNum</tt><tt class="py-op">)</tt><tt class="py-op">)</tt> </tt>
<a name="L225"></a><tt class="py-lineno">225</tt>  <tt class="py-line">                <tt class="py-name">seconds</tt> <tt class="py-op">=</tt> <tt class="py-name">timeNum</tt> <tt class="py-op">&amp;</tt> <tt class="py-name">int</tt><tt class="py-op">(</tt><tt class="py-string">'11111'</tt><tt class="py-op">,</tt> <tt class="py-number">2</tt><tt class="py-op">)</tt> <tt class="py-comment"># First 5 LSBs</tt> </tt>
<a name="L226"></a><tt class="py-lineno">226</tt>  <tt class="py-line">                <tt class="py-name">minutes</tt> <tt class="py-op">=</tt> <tt class="py-op">(</tt><tt class="py-name">timeNum</tt> <tt class="py-op">&amp;</tt> <tt class="py-name">int</tt><tt class="py-op">(</tt><tt class="py-string">'11111100000'</tt><tt class="py-op">,</tt> <tt class="py-number">2</tt><tt class="py-op">)</tt><tt class="py-op">)</tt> <tt class="py-op">&gt;&gt;</tt> <tt class="py-number">5</tt> <tt class="py-comment"># Next 6 bits minus first 5 LSBs</tt> </tt>
<a name="L227"></a><tt class="py-lineno">227</tt>  <tt class="py-line">                <tt class="py-name">hour</tt> <tt class="py-op">=</tt> <tt class="py-name">timeNum</tt> <tt class="py-op">&gt;&gt;</tt> <tt class="py-number">11</tt> <tt class="py-comment"># Last 5 bits minus the first 11 LSBs</tt> </tt>
<a name="L228"></a><tt class="py-lineno">228</tt>  <tt class="py-line">                 </tt>
<a name="L229"></a><tt class="py-lineno">229</tt>  <tt class="py-line">                <tt class="py-keyword">if</tt> <tt class="py-name">hour</tt> <tt class="py-op">&gt;</tt> <tt class="py-number">23</tt> <tt class="py-keyword">or</tt> <tt class="py-name">minutes</tt> <tt class="py-op">&gt;</tt> <tt class="py-number">59</tt> <tt class="py-keyword">or</tt> <tt class="py-name">seconds</tt> <tt class="py-op">&gt;</tt> <tt class="py-number">29</tt><tt class="py-op">:</tt> </tt>
<a name="L230"></a><tt class="py-lineno">230</tt>  <tt class="py-line">                        <tt class="py-keyword">raise</tt> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt id="link-37" class="py-name"><a title="Forensie.Forensie.FormatError" class="py-name" href="#" onclick="return doclink('link-37', 'FormatError', 'link-9');">FormatError</a></tt><tt class="py-op">(</tt><tt class="py-string">'Time value %d has an improper hour, minute, or second value: '</tt> <tt class="py-op">%</tt> <tt class="py-name">timeNum</tt><tt class="py-op">)</tt> </tt>
<a name="L231"></a><tt class="py-lineno">231</tt>  <tt class="py-line">                 </tt>
<a name="L232"></a><tt class="py-lineno">232</tt>  <tt class="py-line">                <tt class="py-keyword">return</tt> <tt class="py-op">(</tt><tt class="py-name">hour</tt><tt class="py-op">,</tt> <tt class="py-name">minutes</tt><tt class="py-op">,</tt> <tt class="py-op">(</tt><tt class="py-number">2</tt> <tt class="py-op">*</tt> <tt class="py-name">seconds</tt><tt class="py-op">)</tt><tt class="py-op">+</tt><tt class="py-name">msec</tt><tt class="py-op">)</tt> </tt>
</div><a name="L233"></a><tt class="py-lineno">233</tt>  <tt class="py-line">         </tt>
<a name="Forensie.DateTimeDetector"></a><div id="Forensie.DateTimeDetector-def"><a name="L234"></a><tt class="py-lineno">234</tt> <a class="py-toggle" href="#" id="Forensie.DateTimeDetector-toggle" onclick="return toggle('Forensie.DateTimeDetector');">-</a><tt class="py-line">        <tt class="py-keyword">def</tt> <a class="py-def-name" href="Forensie.Forensie-class.html#DateTimeDetector">DateTimeDetector</a><tt class="py-op">(</tt><tt class="py-param">self</tt><tt class="py-op">)</tt><tt class="py-op">:</tt> </tt>
</div><div id="Forensie.DateTimeDetector-collapsed" style="display:none;" pad="+++" indent="++++++++++++"></div><div id="Forensie.DateTimeDetector-expanded"><a name="L235"></a><tt class="py-lineno">235</tt>  <tt class="py-line">                <tt class="py-docstring">"""Detects and interprets an FAT date and time value by calling </tt> </tt>
<a name="L236"></a><tt class="py-lineno">236</tt>  <tt class="py-line"><tt class="py-docstring">                DateDetector() and TimeDetector() with the raw option set to True.</tt> </tt>
<a name="L237"></a><tt class="py-lineno">237</tt>  <tt class="py-line"><tt class="py-docstring">                </tt> </tt>
<a name="L238"></a><tt class="py-lineno">238</tt>  <tt class="py-line"><tt class="py-docstring">                Returns a regular success tuple (see ProcessInput()).</tt> </tt>
<a name="L239"></a><tt class="py-lineno">239</tt>  <tt class="py-line"><tt class="py-docstring">                """</tt> </tt>
<a name="L240"></a><tt class="py-lineno">240</tt>  <tt class="py-line">                <tt class="py-comment"># Acceptable length for this kind of processing is either 8 or 10</tt> </tt>
<a name="L241"></a><tt class="py-lineno">241</tt>  <tt class="py-line">                <tt class="py-keyword">if</tt> <tt class="py-name">len</tt><tt class="py-op">(</tt><tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">inputStr</tt><tt class="py-op">)</tt> <tt class="py-keyword">not</tt> <tt class="py-keyword">in</tt> <tt class="py-op">(</tt><tt class="py-number">8</tt><tt class="py-op">,</tt> <tt class="py-number">10</tt><tt class="py-op">)</tt><tt class="py-op">:</tt> <tt class="py-keyword">raise</tt> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt id="link-38" class="py-name"><a title="Forensie.Forensie.FormatError" class="py-name" href="#" onclick="return doclink('link-38', 'FormatError', 'link-9');">FormatError</a></tt><tt class="py-op">(</tt><tt class="py-string">'Datetime value has improper length of %d, expected 8 or 10'</tt> <tt class="py-op">%</tt> <tt class="py-name">len</tt><tt class="py-op">(</tt><tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">inputStr</tt><tt class="py-op">)</tt><tt class="py-op">)</tt> </tt>
<a name="L242"></a><tt class="py-lineno">242</tt>  <tt class="py-line">                 </tt>
<a name="L243"></a><tt class="py-lineno">243</tt>  <tt class="py-line">                <tt class="py-name">date</tt> <tt class="py-op">=</tt> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt id="link-39" class="py-name"><a title="Forensie.Forensie.DateDetector" class="py-name" href="#" onclick="return doclink('link-39', 'DateDetector', 'link-16');">DateDetector</a></tt><tt class="py-op">(</tt><tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">inputStr</tt><tt class="py-op">[</tt><tt class="py-op">-</tt><tt class="py-number">4</tt><tt class="py-op">:</tt><tt class="py-op">]</tt><tt class="py-op">,</tt> <tt class="py-name">True</tt><tt class="py-op">)</tt> </tt>
<a name="L244"></a><tt class="py-lineno">244</tt>  <tt class="py-line">                <tt class="py-name">time</tt> <tt class="py-op">=</tt> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt id="link-40" class="py-name"><a title="Forensie.Forensie.TimeDetector" class="py-name" href="#" onclick="return doclink('link-40', 'TimeDetector', 'link-17');">TimeDetector</a></tt><tt class="py-op">(</tt><tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">inputStr</tt><tt class="py-op">[</tt><tt class="py-op">:</tt><tt class="py-op">-</tt><tt class="py-number">4</tt><tt class="py-op">]</tt><tt class="py-op">,</tt> <tt class="py-name">True</tt><tt class="py-op">)</tt> </tt>
<a name="L245"></a><tt class="py-lineno">245</tt>  <tt class="py-line">                <tt class="py-keyword">return</tt> <tt class="py-op">(</tt><tt class="py-string">'Time &amp; Date Value: %02d:%02d:%05.2f, %d %s, %d\nProcessed for %s endian format'</tt> <tt class="py-op">%</tt> <tt class="py-op">(</tt><tt class="py-name">time</tt><tt class="py-op">+</tt><tt class="py-name">date</tt><tt class="py-op">+</tt><tt class="py-op">(</tt><tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">endian</tt><tt class="py-op">,</tt><tt class="py-op">)</tt><tt class="py-op">)</tt><tt class="py-op">,</tt> <tt class="py-string">'success'</tt><tt class="py-op">,</tt> <tt class="py-string">'datetime'</tt><tt class="py-op">)</tt> </tt>
</div><a name="L246"></a><tt class="py-lineno">246</tt>  <tt class="py-line">         </tt>
<a name="Forensie.GetCommand"></a><div id="Forensie.GetCommand-def"><a name="L247"></a><tt class="py-lineno">247</tt> <a class="py-toggle" href="#" id="Forensie.GetCommand-toggle" onclick="return toggle('Forensie.GetCommand');">-</a><tt class="py-line">        <tt class="py-keyword">def</tt> <a class="py-def-name" href="Forensie.Forensie-class.html#GetCommand">GetCommand</a><tt class="py-op">(</tt><tt class="py-param">self</tt><tt class="py-op">,</tt> <tt class="py-param">lines</tt><tt class="py-op">)</tt><tt class="py-op">:</tt> </tt>
</div><div id="Forensie.GetCommand-collapsed" style="display:none;" pad="+++" indent="++++++++++++"></div><div id="Forensie.GetCommand-expanded"><a name="L248"></a><tt class="py-lineno">248</tt>  <tt class="py-line">                <tt class="py-docstring">"""Searches lines for supported commands which are then stored in the </tt> </tt>
<a name="L249"></a><tt class="py-lineno">249</tt>  <tt class="py-line"><tt class="py-docstring">                self.commands list. Any words that are not commands are simply </tt> </tt>
<a name="L250"></a><tt class="py-lineno">250</tt>  <tt class="py-line"><tt class="py-docstring">                ignored.</tt> </tt>
<a name="L251"></a><tt class="py-lineno">251</tt>  <tt class="py-line"><tt class="py-docstring">                </tt> </tt>
<a name="L252"></a><tt class="py-lineno">252</tt>  <tt class="py-line"><tt class="py-docstring">                No return value.</tt> </tt>
<a name="L253"></a><tt class="py-lineno">253</tt>  <tt class="py-line"><tt class="py-docstring">                """</tt> </tt>
<a name="L254"></a><tt class="py-lineno">254</tt>  <tt class="py-line">                <tt class="py-name">coms</tt> <tt class="py-op">=</tt> <tt class="py-op">[</tt><tt class="py-op">]</tt> </tt>
<a name="L255"></a><tt class="py-lineno">255</tt>  <tt class="py-line">                <tt class="py-keyword">for</tt> <tt class="py-name">line</tt> <tt class="py-keyword">in</tt> <tt class="py-name">lines</tt><tt class="py-op">:</tt> </tt>
<a name="L256"></a><tt class="py-lineno">256</tt>  <tt class="py-line">                        <tt class="py-comment">#print line</tt> </tt>
<a name="L257"></a><tt class="py-lineno">257</tt>  <tt class="py-line">                        <tt class="py-keyword">if</tt> <tt class="py-string">"&gt;&gt;"</tt> <tt class="py-op">==</tt> <tt class="py-name">line</tt><tt class="py-op">[</tt><tt class="py-op">:</tt><tt class="py-number">2</tt><tt class="py-op">]</tt><tt class="py-op">:</tt> </tt>
<a name="L258"></a><tt class="py-lineno">258</tt>  <tt class="py-line">                                <tt class="py-keyword">for</tt> <tt class="py-name">x</tt> <tt class="py-keyword">in</tt> <tt class="py-name">line</tt><tt class="py-op">[</tt><tt class="py-number">2</tt><tt class="py-op">:</tt><tt class="py-op">]</tt><tt class="py-op">.</tt><tt class="py-name">split</tt><tt class="py-op">(</tt><tt class="py-op">)</tt><tt class="py-op">:</tt> </tt>
<a name="L259"></a><tt class="py-lineno">259</tt>  <tt class="py-line">                                        <tt class="py-keyword">if</tt> <tt class="py-name">x</tt><tt class="py-op">.</tt><tt class="py-name">strip</tt><tt class="py-op">(</tt><tt class="py-op">)</tt> <tt class="py-op">==</tt> <tt class="py-string">''</tt><tt class="py-op">:</tt> <tt class="py-keyword">continue</tt> </tt>
<a name="L260"></a><tt class="py-lineno">260</tt>  <tt class="py-line">                                        <tt class="py-keyword">elif</tt> <tt class="py-name">x</tt><tt class="py-op">.</tt><tt class="py-name">lower</tt><tt class="py-op">(</tt><tt class="py-op">)</tt> <tt class="py-keyword">in</tt> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">supported_commands</tt><tt class="py-op">:</tt> </tt>
<a name="L261"></a><tt class="py-lineno">261</tt>  <tt class="py-line">                                                <tt class="py-comment">#print "Command found: %s" % x.lower()</tt> </tt>
<a name="L262"></a><tt class="py-lineno">262</tt>  <tt class="py-line">                                                <tt class="py-name">coms</tt> <tt class="py-op">+=</tt> <tt class="py-op">[</tt><tt class="py-name">x</tt><tt class="py-op">.</tt><tt class="py-name">lower</tt><tt class="py-op">(</tt><tt class="py-op">)</tt><tt class="py-op">]</tt> </tt>
<a name="L263"></a><tt class="py-lineno">263</tt>  <tt class="py-line">                <tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">commands</tt> <tt class="py-op">=</tt> <tt class="py-name">coms</tt> </tt>
</div><a name="L264"></a><tt class="py-lineno">264</tt>  <tt class="py-line">         </tt>
<a name="Forensie.GetPartInfo"></a><div id="Forensie.GetPartInfo-def"><a name="L265"></a><tt class="py-lineno">265</tt> <a class="py-toggle" href="#" id="Forensie.GetPartInfo-toggle" onclick="return toggle('Forensie.GetPartInfo');">-</a><tt class="py-line">        <tt class="py-keyword">def</tt> <a class="py-def-name" href="Forensie.Forensie-class.html#GetPartInfo">GetPartInfo</a><tt class="py-op">(</tt><tt class="py-param">self</tt><tt class="py-op">,</tt> <tt class="py-param">entry</tt><tt class="py-op">)</tt><tt class="py-op">:</tt> </tt>
</div><div id="Forensie.GetPartInfo-collapsed" style="display:none;" pad="+++" indent="++++++++++++"></div><div id="Forensie.GetPartInfo-expanded"><a name="L266"></a><tt class="py-lineno">266</tt>  <tt class="py-line">                <tt class="py-docstring">"""Retrieves a single primary partition's information from entry, </tt> </tt>
<a name="L267"></a><tt class="py-lineno">267</tt>  <tt class="py-line"><tt class="py-docstring">                stores it in a dictionary, and returns the dictionary. The entry </tt> </tt>
<a name="L268"></a><tt class="py-lineno">268</tt>  <tt class="py-line"><tt class="py-docstring">                must be in standard IBM compatible partition table format.</tt> </tt>
<a name="L269"></a><tt class="py-lineno">269</tt>  <tt class="py-line"><tt class="py-docstring">                """</tt> </tt>
<a name="L270"></a><tt class="py-lineno">270</tt>  <tt class="py-line">                <tt class="py-keyword">if</tt> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">endian</tt> <tt class="py-op">==</tt> <tt class="py-string">'little'</tt><tt class="py-op">:</tt> <tt class="py-name">order</tt> <tt class="py-op">=</tt> <tt class="py-op">-</tt><tt class="py-number">1</tt> </tt>
<a name="L271"></a><tt class="py-lineno">271</tt>  <tt class="py-line">                <tt class="py-keyword">else</tt><tt class="py-op">:</tt> <tt class="py-name">order</tt> <tt class="py-op">=</tt> <tt class="py-number">1</tt> </tt>
<a name="L272"></a><tt class="py-lineno">272</tt>  <tt class="py-line">                 </tt>
<a name="L273"></a><tt class="py-lineno">273</tt>  <tt class="py-line">                <tt class="py-name">info</tt> <tt class="py-op">=</tt> <tt class="py-op">{</tt><tt class="py-op">}</tt> </tt>
<a name="L274"></a><tt class="py-lineno">274</tt>  <tt class="py-line">                <tt class="py-keyword">if</tt> <tt class="py-name">entry</tt><tt class="py-op">[</tt><tt class="py-number">0</tt><tt class="py-op">]</tt> <tt class="py-op">==</tt> <tt class="py-string">'00'</tt><tt class="py-op">:</tt> </tt>
<a name="L275"></a><tt class="py-lineno">275</tt>  <tt class="py-line">                        <tt class="py-name">info</tt><tt class="py-op">[</tt><tt class="py-string">'State'</tt><tt class="py-op">]</tt> <tt class="py-op">=</tt> <tt class="py-string">'Inactive'</tt> </tt>
<a name="L276"></a><tt class="py-lineno">276</tt>  <tt class="py-line">                <tt class="py-keyword">elif</tt> <tt class="py-name">entry</tt><tt class="py-op">[</tt><tt class="py-number">0</tt><tt class="py-op">]</tt> <tt class="py-op">==</tt> <tt class="py-string">'80'</tt><tt class="py-op">:</tt> </tt>
<a name="L277"></a><tt class="py-lineno">277</tt>  <tt class="py-line">                        <tt class="py-name">info</tt><tt class="py-op">[</tt><tt class="py-string">'State'</tt><tt class="py-op">]</tt> <tt class="py-op">=</tt> <tt class="py-string">'Active'</tt> </tt>
<a name="L278"></a><tt class="py-lineno">278</tt>  <tt class="py-line">                <tt class="py-keyword">else</tt><tt class="py-op">:</tt> </tt>
<a name="L279"></a><tt class="py-lineno">279</tt>  <tt class="py-line">                        <tt class="py-name">info</tt><tt class="py-op">[</tt><tt class="py-string">'State'</tt><tt class="py-op">]</tt> <tt class="py-op">=</tt> <tt class="py-string">'Invalid value'</tt> </tt>
<a name="L280"></a><tt class="py-lineno">280</tt>  <tt class="py-line">                 </tt>
<a name="L281"></a><tt class="py-lineno">281</tt>  <tt class="py-line">                <tt class="py-name">info</tt><tt class="py-op">[</tt><tt class="py-string">'CHS Address'</tt><tt class="py-op">]</tt> <tt class="py-op">=</tt> <tt class="py-string">'Head: %d; Cylinder: %d; Sector: %d'</tt> <tt class="py-op">%</tt> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt id="link-41" class="py-name" targets="Method Forensie.Forensie.GetCHS()=Forensie.Forensie-class.html#GetCHS"><a title="Forensie.Forensie.GetCHS" class="py-name" href="#" onclick="return doclink('link-41', 'GetCHS', 'link-41');">GetCHS</a></tt><tt class="py-op">(</tt><tt class="py-name">entry</tt><tt class="py-op">)</tt> </tt>
<a name="L282"></a><tt class="py-lineno">282</tt>  <tt class="py-line">                 </tt>
<a name="L283"></a><tt class="py-lineno">283</tt>  <tt class="py-line">                <tt class="py-keyword">try</tt><tt class="py-op">:</tt> </tt>
<a name="L284"></a><tt class="py-lineno">284</tt>  <tt class="py-line">                        <tt class="py-name">info</tt><tt class="py-op">[</tt><tt class="py-string">'Partition Type'</tt><tt class="py-op">]</tt> <tt class="py-op">=</tt> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">PType</tt><tt class="py-op">[</tt><tt class="py-name">entry</tt><tt class="py-op">[</tt><tt class="py-number">4</tt><tt class="py-op">]</tt><tt class="py-op">]</tt> </tt>
<a name="L285"></a><tt class="py-lineno">285</tt>  <tt class="py-line">                <tt class="py-keyword">except</tt> <tt class="py-name">KeyError</tt><tt class="py-op">:</tt> <tt class="py-comment"># Invalid entry, may be VBR instead of MBR</tt> </tt>
<a name="L286"></a><tt class="py-lineno">286</tt>  <tt class="py-line">                        <tt class="py-name">info</tt><tt class="py-op">[</tt><tt class="py-string">'Partition Type'</tt><tt class="py-op">]</tt> <tt class="py-op">=</tt> <tt class="py-string">"Unknown - Input may be VBR instead of MBR"</tt> </tt>
<a name="L287"></a><tt class="py-lineno">287</tt>  <tt class="py-line">                <tt class="py-comment">#l = []</tt> </tt>
<a name="L288"></a><tt class="py-lineno">288</tt>  <tt class="py-line">                <tt class="py-comment">#for x in xrange(256):</tt> </tt>
<a name="L289"></a><tt class="py-lineno">289</tt>  <tt class="py-line">                <tt class="py-comment">#       l.append('%02x' % x)</tt> </tt>
<a name="L290"></a><tt class="py-lineno">290</tt>  <tt class="py-line">                 </tt>
<a name="L291"></a><tt class="py-lineno">291</tt>  <tt class="py-line">                <tt class="py-name">info</tt><tt class="py-op">[</tt><tt class="py-string">'End CHS Address'</tt><tt class="py-op">]</tt> <tt class="py-op">=</tt> <tt class="py-string">'Head: %d; Cylinder: %d; Sector: %d'</tt> <tt class="py-op">%</tt> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt id="link-42" class="py-name"><a title="Forensie.Forensie.GetCHS" class="py-name" href="#" onclick="return doclink('link-42', 'GetCHS', 'link-41');">GetCHS</a></tt><tt class="py-op">(</tt><tt class="py-name">entry</tt><tt class="py-op">,</tt> <tt class="py-name">True</tt><tt class="py-op">)</tt> </tt>
<a name="L292"></a><tt class="py-lineno">292</tt>  <tt class="py-line">                 </tt>
<a name="L293"></a><tt class="py-lineno">293</tt>  <tt class="py-line">                <tt class="py-comment"># LBA of first sector and Number of blocks: Not always used</tt> </tt>
<a name="L294"></a><tt class="py-lineno">294</tt>  <tt class="py-line">                <tt class="py-name">lbaVals</tt> <tt class="py-op">=</tt> <tt class="py-op">[</tt><tt class="py-op">]</tt> </tt>
<a name="L295"></a><tt class="py-lineno">295</tt>  <tt class="py-line">                <tt class="py-keyword">if</tt> <tt class="py-name">order</tt> <tt class="py-op">==</tt> <tt class="py-op">-</tt><tt class="py-number">1</tt><tt class="py-op">:</tt> </tt>
<a name="L296"></a><tt class="py-lineno">296</tt>  <tt class="py-line">                        <tt class="py-name">lbaVals</tt> <tt class="py-op">=</tt> <tt class="py-name">entry</tt><tt class="py-op">[</tt><tt class="py-number">11</tt><tt class="py-op">:</tt><tt class="py-number">7</tt><tt class="py-op">:</tt><tt class="py-op">-</tt><tt class="py-number">1</tt><tt class="py-op">]</tt> </tt>
<a name="L297"></a><tt class="py-lineno">297</tt>  <tt class="py-line">                <tt class="py-keyword">elif</tt> <tt class="py-name">order</tt> <tt class="py-op">==</tt> <tt class="py-number">1</tt><tt class="py-op">:</tt> </tt>
<a name="L298"></a><tt class="py-lineno">298</tt>  <tt class="py-line">                        <tt class="py-name">lbaVals</tt> <tt class="py-op">=</tt> <tt class="py-name">entry</tt><tt class="py-op">[</tt><tt class="py-number">8</tt><tt class="py-op">:</tt><tt class="py-number">12</tt><tt class="py-op">]</tt> </tt>
<a name="L299"></a><tt class="py-lineno">299</tt>  <tt class="py-line">                <tt class="py-name">lbaStr</tt> <tt class="py-op">=</tt> <tt class="py-string">''</tt> </tt>
<a name="L300"></a><tt class="py-lineno">300</tt>  <tt class="py-line">                <tt class="py-keyword">for</tt> <tt class="py-name">x</tt> <tt class="py-keyword">in</tt> <tt class="py-name">lbaVals</tt><tt class="py-op">:</tt> </tt>
<a name="L301"></a><tt class="py-lineno">301</tt>  <tt class="py-line">                        <tt class="py-name">lbaStr</tt> <tt class="py-op">+=</tt> <tt class="py-name">x</tt> </tt>
<a name="L302"></a><tt class="py-lineno">302</tt>  <tt class="py-line">                <tt class="py-name">info</tt><tt class="py-op">[</tt><tt class="py-string">'LBA of First Sector'</tt><tt class="py-op">]</tt> <tt class="py-op">=</tt> <tt class="py-name">int</tt><tt class="py-op">(</tt><tt class="py-name">lbaStr</tt><tt class="py-op">,</tt> <tt class="py-number">16</tt><tt class="py-op">)</tt> </tt>
<a name="L303"></a><tt class="py-lineno">303</tt>  <tt class="py-line">                 </tt>
<a name="L304"></a><tt class="py-lineno">304</tt>  <tt class="py-line">                <tt class="py-name">blocksVals</tt> <tt class="py-op">=</tt> <tt class="py-op">[</tt><tt class="py-op">]</tt> </tt>
<a name="L305"></a><tt class="py-lineno">305</tt>  <tt class="py-line">                <tt class="py-keyword">if</tt> <tt class="py-name">order</tt> <tt class="py-op">==</tt> <tt class="py-op">-</tt><tt class="py-number">1</tt><tt class="py-op">:</tt> </tt>
<a name="L306"></a><tt class="py-lineno">306</tt>  <tt class="py-line">                        <tt class="py-name">blocksVals</tt> <tt class="py-op">=</tt> <tt class="py-name">entry</tt><tt class="py-op">[</tt><tt class="py-number">15</tt><tt class="py-op">:</tt><tt class="py-number">11</tt><tt class="py-op">:</tt><tt class="py-op">-</tt><tt class="py-number">1</tt><tt class="py-op">]</tt> </tt>
<a name="L307"></a><tt class="py-lineno">307</tt>  <tt class="py-line">                <tt class="py-keyword">elif</tt> <tt class="py-name">order</tt> <tt class="py-op">==</tt> <tt class="py-number">1</tt><tt class="py-op">:</tt> </tt>
<a name="L308"></a><tt class="py-lineno">308</tt>  <tt class="py-line">                        <tt class="py-name">blocksVals</tt> <tt class="py-op">=</tt> <tt class="py-name">entry</tt><tt class="py-op">[</tt><tt class="py-number">12</tt><tt class="py-op">:</tt><tt class="py-number">16</tt><tt class="py-op">]</tt> </tt>
<a name="L309"></a><tt class="py-lineno">309</tt>  <tt class="py-line">                <tt class="py-name">blocksStr</tt> <tt class="py-op">=</tt> <tt class="py-string">''</tt> </tt>
<a name="L310"></a><tt class="py-lineno">310</tt>  <tt class="py-line">                <tt class="py-keyword">for</tt> <tt class="py-name">x</tt> <tt class="py-keyword">in</tt> <tt class="py-name">blocksVals</tt><tt class="py-op">:</tt> </tt>
<a name="L311"></a><tt class="py-lineno">311</tt>  <tt class="py-line">                        <tt class="py-name">blocksStr</tt> <tt class="py-op">+=</tt> <tt class="py-name">x</tt> </tt>
<a name="L312"></a><tt class="py-lineno">312</tt>  <tt class="py-line">                <tt class="py-name">info</tt><tt class="py-op">[</tt><tt class="py-string">'Number of Blocks'</tt><tt class="py-op">]</tt> <tt class="py-op">=</tt> <tt class="py-name">int</tt><tt class="py-op">(</tt><tt class="py-name">blocksStr</tt><tt class="py-op">,</tt> <tt class="py-number">16</tt><tt class="py-op">)</tt> </tt>
<a name="L313"></a><tt class="py-lineno">313</tt>  <tt class="py-line">                 </tt>
<a name="L314"></a><tt class="py-lineno">314</tt>  <tt class="py-line">                <tt class="py-keyword">return</tt> <tt class="py-name">info</tt> </tt>
</div><a name="L315"></a><tt class="py-lineno">315</tt>  <tt class="py-line"> </tt>
<a name="Forensie.FATVBRdetector"></a><div id="Forensie.FATVBRdetector-def"><a name="L316"></a><tt class="py-lineno">316</tt> <a class="py-toggle" href="#" id="Forensie.FATVBRdetector-toggle" onclick="return toggle('Forensie.FATVBRdetector');">-</a><tt class="py-line">        <tt class="py-keyword">def</tt> <a class="py-def-name" href="Forensie.Forensie-class.html#FATVBRdetector">FATVBRdetector</a><tt class="py-op">(</tt><tt class="py-param">self</tt><tt class="py-op">)</tt><tt class="py-op">:</tt> </tt>
</div><div id="Forensie.FATVBRdetector-collapsed" style="display:none;" pad="+++" indent="++++++++++++"></div><div id="Forensie.FATVBRdetector-expanded"><a name="L317"></a><tt class="py-lineno">317</tt>  <tt class="py-line">                <tt class="py-docstring">"""Entry point for interpreting the input as an FAT VBR. Begins </tt> </tt>
<a name="L318"></a><tt class="py-lineno">318</tt>  <tt class="py-line"><tt class="py-docstring">                processing the input text and determines if the length and boot </tt> </tt>
<a name="L319"></a><tt class="py-lineno">319</tt>  <tt class="py-line"><tt class="py-docstring">                signature are valid before proceeding. If the input text passes </tt> </tt>
<a name="L320"></a><tt class="py-lineno">320</tt>  <tt class="py-line"><tt class="py-docstring">                these tests, it is passed on to GetFATInfo().</tt> </tt>
<a name="L321"></a><tt class="py-lineno">321</tt>  <tt class="py-line"><tt class="py-docstring">                </tt> </tt>
<a name="L322"></a><tt class="py-lineno">322</tt>  <tt class="py-line"><tt class="py-docstring">                Returns a regular success tuple (see ProcessInput()).</tt> </tt>
<a name="L323"></a><tt class="py-lineno">323</tt>  <tt class="py-line"><tt class="py-docstring">                """</tt> </tt>
<a name="L324"></a><tt class="py-lineno">324</tt>  <tt class="py-line">                <tt class="py-comment"># Check size, signature, much like MBR</tt> </tt>
<a name="L325"></a><tt class="py-lineno">325</tt>  <tt class="py-line">                <tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">bytes</tt> <tt class="py-op">=</tt> <tt id="link-43" class="py-name"><a title="Forensie.ChopHexStr" class="py-name" href="#" onclick="return doclink('link-43', 'ChopHexStr', 'link-21');">ChopHexStr</a></tt><tt class="py-op">(</tt><tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">inputStr</tt><tt class="py-op">)</tt> </tt>
<a name="L326"></a><tt class="py-lineno">326</tt>  <tt class="py-line">                 </tt>
<a name="L327"></a><tt class="py-lineno">327</tt>  <tt class="py-line">                <tt class="py-comment"># Check length of string</tt> </tt>
<a name="L328"></a><tt class="py-lineno">328</tt>  <tt class="py-line">                <tt class="py-keyword">if</tt> <tt class="py-name">len</tt><tt class="py-op">(</tt><tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">bytes</tt><tt class="py-op">)</tt> <tt class="py-op">!=</tt> <tt class="py-number">512</tt><tt class="py-op">:</tt> </tt>
<a name="L329"></a><tt class="py-lineno">329</tt>  <tt class="py-line">                        <tt class="py-keyword">raise</tt> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt id="link-44" class="py-name"><a title="Forensie.Forensie.FormatError" class="py-name" href="#" onclick="return doclink('link-44', 'FormatError', 'link-9');">FormatError</a></tt><tt class="py-op">(</tt><tt class="py-string">'FAT VBR is of improper length: %d, expected 512'</tt> <tt class="py-op">%</tt> <tt class="py-name">len</tt><tt class="py-op">(</tt><tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">bytes</tt><tt class="py-op">)</tt><tt class="py-op">)</tt> </tt>
<a name="L330"></a><tt class="py-lineno">330</tt>  <tt class="py-line">                 </tt>
<a name="L331"></a><tt class="py-lineno">331</tt>  <tt class="py-line">                <tt class="py-comment"># Determine Endian</tt> </tt>
<a name="L332"></a><tt class="py-lineno">332</tt>  <tt class="py-line">                <tt class="py-keyword">if</tt> <tt class="py-op">[</tt><tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">bytes</tt><tt class="py-op">[</tt><tt class="py-op">-</tt><tt class="py-number">2</tt><tt class="py-op">]</tt><tt class="py-op">,</tt> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">bytes</tt><tt class="py-op">[</tt><tt class="py-op">-</tt><tt class="py-number">1</tt><tt class="py-op">]</tt><tt class="py-op">.</tt><tt class="py-name">upper</tt><tt class="py-op">(</tt><tt class="py-op">)</tt><tt class="py-op">]</tt> <tt class="py-op">==</tt> <tt class="py-op">[</tt><tt class="py-string">'55'</tt><tt class="py-op">,</tt> <tt class="py-string">'AA'</tt><tt class="py-op">]</tt><tt class="py-op">:</tt> </tt>
<a name="L333"></a><tt class="py-lineno">333</tt>  <tt class="py-line">                        <tt class="py-comment"># Little Endian</tt> </tt>
<a name="L334"></a><tt class="py-lineno">334</tt>  <tt class="py-line">                        <tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">endian</tt> <tt class="py-op">=</tt> <tt class="py-string">'little'</tt> </tt>
<a name="L335"></a><tt class="py-lineno">335</tt>  <tt class="py-line">                <tt class="py-keyword">elif</tt> <tt class="py-op">[</tt><tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">bytes</tt><tt class="py-op">[</tt><tt class="py-op">-</tt><tt class="py-number">2</tt><tt class="py-op">]</tt><tt class="py-op">.</tt><tt class="py-name">upper</tt><tt class="py-op">(</tt><tt class="py-op">)</tt><tt class="py-op">,</tt> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">bytes</tt><tt class="py-op">[</tt><tt class="py-op">-</tt><tt class="py-number">1</tt><tt class="py-op">]</tt><tt class="py-op">]</tt> <tt class="py-op">==</tt> <tt class="py-op">[</tt><tt class="py-string">'AA'</tt><tt class="py-op">,</tt> <tt class="py-string">'55'</tt><tt class="py-op">]</tt><tt class="py-op">:</tt> </tt>
<a name="L336"></a><tt class="py-lineno">336</tt>  <tt class="py-line">                        <tt class="py-comment"># Big Endian</tt> </tt>
<a name="L337"></a><tt class="py-lineno">337</tt>  <tt class="py-line">                        <tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">endian</tt> <tt class="py-op">=</tt> <tt class="py-string">'big'</tt> </tt>
<a name="L338"></a><tt class="py-lineno">338</tt>  <tt class="py-line">                <tt class="py-keyword">else</tt><tt class="py-op">:</tt> </tt>
<a name="L339"></a><tt class="py-lineno">339</tt>  <tt class="py-line">                        <tt class="py-keyword">raise</tt> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt id="link-45" class="py-name"><a title="Forensie.Forensie.FormatError" class="py-name" href="#" onclick="return doclink('link-45', 'FormatError', 'link-9');">FormatError</a></tt><tt class="py-op">(</tt><tt class="py-string">'FAT VBR does not have a valid signature.'</tt><tt class="py-op">)</tt> </tt>
<a name="L340"></a><tt class="py-lineno">340</tt>  <tt class="py-line">                 </tt>
<a name="L341"></a><tt class="py-lineno">341</tt>  <tt class="py-line">                <tt class="py-keyword">return</tt> <tt class="py-op">(</tt><tt class="py-name">self</tt><tt class="py-op">.</tt><tt id="link-46" class="py-name" targets="Method Forensie.Forensie.FormatFATInfo()=Forensie.Forensie-class.html#FormatFATInfo"><a title="Forensie.Forensie.FormatFATInfo" class="py-name" href="#" onclick="return doclink('link-46', 'FormatFATInfo', 'link-46');">FormatFATInfo</a></tt><tt class="py-op">(</tt><tt class="py-name">self</tt><tt class="py-op">.</tt><tt id="link-47" class="py-name" targets="Method Forensie.Forensie.GetFATInfo()=Forensie.Forensie-class.html#GetFATInfo"><a title="Forensie.Forensie.GetFATInfo" class="py-name" href="#" onclick="return doclink('link-47', 'GetFATInfo', 'link-47');">GetFATInfo</a></tt><tt class="py-op">(</tt><tt class="py-op">)</tt><tt class="py-op">)</tt><tt class="py-op">,</tt> <tt class="py-string">'success'</tt><tt class="py-op">,</tt> <tt class="py-string">'fat-mbr'</tt><tt class="py-op">)</tt> </tt>
</div><a name="L342"></a><tt class="py-lineno">342</tt>  <tt class="py-line">         </tt>
<a name="Forensie.GetFATInfo"></a><div id="Forensie.GetFATInfo-def"><a name="L343"></a><tt class="py-lineno">343</tt> <a class="py-toggle" href="#" id="Forensie.GetFATInfo-toggle" onclick="return toggle('Forensie.GetFATInfo');">-</a><tt class="py-line">        <tt class="py-keyword">def</tt> <a class="py-def-name" href="Forensie.Forensie-class.html#GetFATInfo">GetFATInfo</a><tt class="py-op">(</tt><tt class="py-param">self</tt><tt class="py-op">)</tt><tt class="py-op">:</tt> </tt>
</div><div id="Forensie.GetFATInfo-collapsed" style="display:none;" pad="+++" indent="++++++++++++"></div><div id="Forensie.GetFATInfo-expanded"><a name="L344"></a><tt class="py-lineno">344</tt>  <tt class="py-line">                <tt class="py-docstring">"""Interprets the information from the FAT boot sector and returns a </tt> </tt>
<a name="L345"></a><tt class="py-lineno">345</tt>  <tt class="py-line"><tt class="py-docstring">                dictionary with it. Works with FAT12/16/32.</tt> </tt>
<a name="L346"></a><tt class="py-lineno">346</tt>  <tt class="py-line"><tt class="py-docstring">                """</tt> </tt>
<a name="L347"></a><tt class="py-lineno">347</tt>  <tt class="py-line">                <tt class="py-comment"># Copy byte information</tt> </tt>
<a name="L348"></a><tt class="py-lineno">348</tt>  <tt class="py-line">                <tt class="py-name">byt</tt> <tt class="py-op">=</tt> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">bytes</tt> </tt>
<a name="L349"></a><tt class="py-lineno">349</tt>  <tt class="py-line">                <tt class="py-name">fatInfo</tt> <tt class="py-op">=</tt> <tt class="py-op">{</tt><tt class="py-op">}</tt> </tt>
<a name="L350"></a><tt class="py-lineno">350</tt>  <tt class="py-line">                <tt class="py-name">fatdata</tt> <tt class="py-op">=</tt> <tt class="py-op">(</tt><tt class="py-op">(</tt><tt class="py-string">'OEM Name'</tt><tt class="py-op">,</tt> <tt class="py-number">3</tt><tt class="py-op">,</tt> <tt class="py-number">8</tt><tt class="py-op">,</tt> <tt class="py-string">'ascii'</tt><tt class="py-op">)</tt><tt class="py-op">,</tt> </tt>
<a name="L351"></a><tt class="py-lineno">351</tt>  <tt class="py-line">                <tt class="py-op">(</tt><tt class="py-string">'Bytes per Sector'</tt><tt class="py-op">,</tt> <tt class="py-number">11</tt><tt class="py-op">,</tt> <tt class="py-number">2</tt><tt class="py-op">,</tt> <tt class="py-string">'num'</tt><tt class="py-op">)</tt><tt class="py-op">,</tt> </tt>
<a name="L352"></a><tt class="py-lineno">352</tt>  <tt class="py-line">                <tt class="py-op">(</tt><tt class="py-string">'Sectors per Cluster'</tt><tt class="py-op">,</tt> <tt class="py-number">13</tt><tt class="py-op">,</tt> <tt class="py-number">1</tt><tt class="py-op">,</tt> <tt class="py-string">'num'</tt><tt class="py-op">)</tt><tt class="py-op">,</tt> </tt>
<a name="L353"></a><tt class="py-lineno">353</tt>  <tt class="py-line">                <tt class="py-op">(</tt><tt class="py-string">'Reserved Sector Count'</tt><tt class="py-op">,</tt> <tt class="py-number">14</tt><tt class="py-op">,</tt> <tt class="py-number">2</tt><tt class="py-op">,</tt> <tt class="py-string">'num'</tt><tt class="py-op">)</tt><tt class="py-op">,</tt> </tt>
<a name="L354"></a><tt class="py-lineno">354</tt>  <tt class="py-line">                <tt class="py-op">(</tt><tt class="py-string">'Number of FATs'</tt><tt class="py-op">,</tt> <tt class="py-number">16</tt><tt class="py-op">,</tt> <tt class="py-number">1</tt><tt class="py-op">,</tt> <tt class="py-string">'num'</tt><tt class="py-op">)</tt><tt class="py-op">,</tt> </tt>
<a name="L355"></a><tt class="py-lineno">355</tt>  <tt class="py-line">                <tt class="py-op">(</tt><tt class="py-string">'Sectors per track'</tt><tt class="py-op">,</tt> <tt class="py-number">24</tt><tt class="py-op">,</tt> <tt class="py-number">2</tt><tt class="py-op">,</tt> <tt class="py-string">'num'</tt><tt class="py-op">)</tt><tt class="py-op">,</tt> </tt>
<a name="L356"></a><tt class="py-lineno">356</tt>  <tt class="py-line">                <tt class="py-op">(</tt><tt class="py-string">'Number of Heads'</tt><tt class="py-op">,</tt> <tt class="py-number">26</tt><tt class="py-op">,</tt> <tt class="py-number">2</tt><tt class="py-op">,</tt> <tt class="py-string">'num'</tt><tt class="py-op">)</tt><tt class="py-op">,</tt> </tt>
<a name="L357"></a><tt class="py-lineno">357</tt>  <tt class="py-line">                <tt class="py-op">(</tt><tt class="py-string">'Hidden Sectors Preceeding'</tt><tt class="py-op">,</tt> <tt class="py-number">28</tt><tt class="py-op">,</tt> <tt class="py-number">4</tt><tt class="py-op">,</tt> <tt class="py-string">'num'</tt><tt class="py-op">)</tt><tt class="py-op">)</tt> </tt>
<a name="L358"></a><tt class="py-lineno">358</tt>  <tt class="py-line">                <tt class="py-keyword">for</tt> <tt class="py-name">w</tt><tt class="py-op">,</tt> <tt class="py-name">x</tt><tt class="py-op">,</tt> <tt class="py-name">y</tt><tt class="py-op">,</tt> <tt class="py-name">z</tt> <tt class="py-keyword">in</tt> <tt class="py-name">fatdata</tt><tt class="py-op">:</tt> </tt>
<a name="L359"></a><tt class="py-lineno">359</tt>  <tt class="py-line">                        <tt class="py-name">self</tt><tt class="py-op">.</tt><tt id="link-48" class="py-name" targets="Method Forensie.Forensie.AddFATInfo()=Forensie.Forensie-class.html#AddFATInfo"><a title="Forensie.Forensie.AddFATInfo" class="py-name" href="#" onclick="return doclink('link-48', 'AddFATInfo', 'link-48');">AddFATInfo</a></tt><tt class="py-op">(</tt><tt class="py-name">fatInfo</tt><tt class="py-op">,</tt> <tt class="py-name">byt</tt><tt class="py-op">,</tt> <tt class="py-name">w</tt><tt class="py-op">,</tt> <tt class="py-name">x</tt><tt class="py-op">,</tt> <tt class="py-name">y</tt><tt class="py-op">,</tt> <tt class="py-name">z</tt><tt class="py-op">)</tt> </tt>
<a name="L360"></a><tt class="py-lineno">360</tt>  <tt class="py-line">                 </tt>
<a name="L361"></a><tt class="py-lineno">361</tt>  <tt class="py-line">                <tt class="py-comment"># Total Sectors Calculation</tt> </tt>
<a name="L362"></a><tt class="py-lineno">362</tt>  <tt class="py-line">                <tt class="py-name">ttlSectors</tt> <tt class="py-op">=</tt> <tt id="link-49" class="py-name"><a title="Forensie.Hex2Dec" class="py-name" href="#" onclick="return doclink('link-49', 'Hex2Dec', 'link-28');">Hex2Dec</a></tt><tt class="py-op">(</tt><tt id="link-50" class="py-name"><a title="Forensie.StrFlatten" class="py-name" href="#" onclick="return doclink('link-50', 'StrFlatten', 'link-4');">StrFlatten</a></tt><tt class="py-op">(</tt><tt class="py-name">byt</tt><tt class="py-op">[</tt><tt class="py-number">19</tt><tt class="py-op">:</tt><tt class="py-number">19</tt><tt class="py-op">+</tt><tt class="py-number">2</tt><tt class="py-op">]</tt><tt class="py-op">)</tt><tt class="py-op">,</tt> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">endian</tt><tt class="py-op">)</tt> </tt>
<a name="L363"></a><tt class="py-lineno">363</tt>  <tt class="py-line">                <tt class="py-keyword">if</tt> <tt class="py-keyword">not</tt> <tt class="py-name">ttlSectors</tt><tt class="py-op">:</tt> </tt>
<a name="L364"></a><tt class="py-lineno">364</tt>  <tt class="py-line">                        <tt class="py-name">ttlSectors</tt> <tt class="py-op">=</tt> <tt id="link-51" class="py-name"><a title="Forensie.Hex2Dec" class="py-name" href="#" onclick="return doclink('link-51', 'Hex2Dec', 'link-28');">Hex2Dec</a></tt><tt class="py-op">(</tt><tt id="link-52" class="py-name"><a title="Forensie.StrFlatten" class="py-name" href="#" onclick="return doclink('link-52', 'StrFlatten', 'link-4');">StrFlatten</a></tt><tt class="py-op">(</tt><tt class="py-name">byt</tt><tt class="py-op">[</tt><tt class="py-number">32</tt><tt class="py-op">:</tt><tt class="py-number">32</tt><tt class="py-op">+</tt><tt class="py-number">4</tt><tt class="py-op">]</tt><tt class="py-op">)</tt><tt class="py-op">,</tt> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">endian</tt><tt class="py-op">)</tt> </tt>
<a name="L365"></a><tt class="py-lineno">365</tt>  <tt class="py-line">                <tt class="py-name">fatInfo</tt><tt class="py-op">[</tt><tt class="py-string">'Total Sectors'</tt><tt class="py-op">]</tt> <tt class="py-op">=</tt> <tt class="py-name">ttlSectors</tt> </tt>
<a name="L366"></a><tt class="py-lineno">366</tt>  <tt class="py-line">                 </tt>
<a name="L367"></a><tt class="py-lineno">367</tt>  <tt class="py-line">                <tt class="py-comment"># Media Descriptor Code Interpretation</tt> </tt>
<a name="L368"></a><tt class="py-lineno">368</tt>  <tt class="py-line">                <tt class="py-name">medDesc</tt> <tt class="py-op">=</tt> <tt id="link-53" class="py-name"><a title="Forensie.Hex2Dec" class="py-name" href="#" onclick="return doclink('link-53', 'Hex2Dec', 'link-28');">Hex2Dec</a></tt><tt class="py-op">(</tt><tt class="py-name">byt</tt><tt class="py-op">[</tt><tt class="py-number">21</tt><tt class="py-op">]</tt><tt class="py-op">,</tt> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">endian</tt><tt class="py-op">)</tt> </tt>
<a name="L369"></a><tt class="py-lineno">369</tt>  <tt class="py-line">                <tt class="py-keyword">if</tt> <tt class="py-name">medDesc</tt> <tt class="py-op">==</tt> <tt class="py-number">240</tt><tt class="py-op">:</tt> </tt>
<a name="L370"></a><tt class="py-lineno">370</tt>  <tt class="py-line">                        <tt class="py-name">fatInfo</tt><tt class="py-op">[</tt><tt class="py-string">'Media Descriptor'</tt><tt class="py-op">]</tt> <tt class="py-op">=</tt> <tt class="py-string">'3.5" Double Sided, 80 tracks per side, 18 or 36 sectors per track (1.44MB or 2.88MB). 5.25" Double Sided, 80 tracks per side, 15 sectors per track (1.2MB). Used also for other media types.'</tt> </tt>
<a name="L371"></a><tt class="py-lineno">371</tt>  <tt class="py-line">                <tt class="py-keyword">elif</tt> <tt class="py-name">medDesc</tt> <tt class="py-op">==</tt> <tt class="py-number">248</tt><tt class="py-op">:</tt> </tt>
<a name="L372"></a><tt class="py-lineno">372</tt>  <tt class="py-line">                        <tt class="py-name">fatInfo</tt><tt class="py-op">[</tt><tt class="py-string">'Media Descriptor'</tt><tt class="py-op">]</tt> <tt class="py-op">=</tt> <tt class="py-string">'Fixed disk (i.e. Hard disk).'</tt> </tt>
<a name="L373"></a><tt class="py-lineno">373</tt>  <tt class="py-line">                <tt class="py-keyword">elif</tt> <tt class="py-name">medDesc</tt> <tt class="py-op">==</tt> <tt class="py-number">249</tt><tt class="py-op">:</tt> </tt>
<a name="L374"></a><tt class="py-lineno">374</tt>  <tt class="py-line">                        <tt class="py-name">fatInfo</tt><tt class="py-op">[</tt><tt class="py-string">'Media Descriptor'</tt><tt class="py-op">]</tt> <tt class="py-op">=</tt> <tt class="py-string">'3.5" Double sided, 80 tracks per side, 9 sectors per track (720K). 5.25" Double sided, 80 tracks per side, 15 sectors per track (1.2MB)'</tt> </tt>
<a name="L375"></a><tt class="py-lineno">375</tt>  <tt class="py-line">                <tt class="py-keyword">elif</tt> <tt class="py-name">medDesc</tt> <tt class="py-op">==</tt> <tt class="py-number">250</tt><tt class="py-op">:</tt> </tt>
<a name="L376"></a><tt class="py-lineno">376</tt>  <tt class="py-line">                        <tt class="py-name">fatInfo</tt><tt class="py-op">[</tt><tt class="py-string">'Media Descriptor'</tt><tt class="py-op">]</tt> <tt class="py-op">=</tt> <tt class="py-string">'5.25" Single sided, 80 tracks per side, 8 sectors per track (320K)'</tt> </tt>
<a name="L377"></a><tt class="py-lineno">377</tt>  <tt class="py-line">                <tt class="py-keyword">elif</tt> <tt class="py-name">medDesc</tt> <tt class="py-op">==</tt> <tt class="py-number">251</tt><tt class="py-op">:</tt> </tt>
<a name="L378"></a><tt class="py-lineno">378</tt>  <tt class="py-line">                        <tt class="py-name">fatInfo</tt><tt class="py-op">[</tt><tt class="py-string">'Media Descriptor'</tt><tt class="py-op">]</tt> <tt class="py-op">=</tt> <tt class="py-string">'3.5" Double sided, 80 tracks per side, 8 sectors per track (640K)'</tt> </tt>
<a name="L379"></a><tt class="py-lineno">379</tt>  <tt class="py-line">                <tt class="py-keyword">elif</tt> <tt class="py-name">medDesc</tt> <tt class="py-op">==</tt> <tt class="py-number">252</tt><tt class="py-op">:</tt> </tt>
<a name="L380"></a><tt class="py-lineno">380</tt>  <tt class="py-line">                        <tt class="py-name">fatInfo</tt><tt class="py-op">[</tt><tt class="py-string">'Media Descriptor'</tt><tt class="py-op">]</tt> <tt class="py-op">=</tt> <tt class="py-string">'5.25" Single sided, 40 tracks per side, 9 sectors per track (180K)'</tt> </tt>
<a name="L381"></a><tt class="py-lineno">381</tt>  <tt class="py-line">                <tt class="py-keyword">elif</tt> <tt class="py-name">medDesc</tt> <tt class="py-op">==</tt> <tt class="py-number">253</tt><tt class="py-op">:</tt> </tt>
<a name="L382"></a><tt class="py-lineno">382</tt>  <tt class="py-line">                        <tt class="py-name">fatInfo</tt><tt class="py-op">[</tt><tt class="py-string">'Media Descriptor'</tt><tt class="py-op">]</tt> <tt class="py-op">=</tt> <tt class="py-string">'5.25" Double sided, 40 tracks per side, 9 sectors per track (360K). Also used for 8".'</tt> </tt>
<a name="L383"></a><tt class="py-lineno">383</tt>  <tt class="py-line">                <tt class="py-keyword">elif</tt> <tt class="py-name">medDesc</tt> <tt class="py-op">==</tt> <tt class="py-number">254</tt><tt class="py-op">:</tt> </tt>
<a name="L384"></a><tt class="py-lineno">384</tt>  <tt class="py-line">                        <tt class="py-name">fatInfo</tt><tt class="py-op">[</tt><tt class="py-string">'Media Descriptor'</tt><tt class="py-op">]</tt> <tt class="py-op">=</tt> <tt class="py-string">'5.25" Single sided, 40 tracks per side, 8 sectors per track (160K). Also used for 8".'</tt> </tt>
<a name="L385"></a><tt class="py-lineno">385</tt>  <tt class="py-line">                <tt class="py-keyword">elif</tt> <tt class="py-name">medDesc</tt> <tt class="py-op">==</tt> <tt class="py-number">255</tt><tt class="py-op">:</tt> </tt>
<a name="L386"></a><tt class="py-lineno">386</tt>  <tt class="py-line">                        <tt class="py-name">fatInfo</tt><tt class="py-op">[</tt><tt class="py-string">'Media Descriptor'</tt><tt class="py-op">]</tt> <tt class="py-op">=</tt> <tt class="py-string">'5.25" Single sided, 40 tracks per side, 8 sectors per track (160K). Also used for 8".'</tt> </tt>
<a name="L387"></a><tt class="py-lineno">387</tt>  <tt class="py-line">                <tt class="py-keyword">else</tt><tt class="py-op">:</tt> </tt>
<a name="L388"></a><tt class="py-lineno">388</tt>  <tt class="py-line">                        <tt class="py-name">fatInfo</tt><tt class="py-op">[</tt><tt class="py-string">'Media Descriptor'</tt><tt class="py-op">]</tt> <tt class="py-op">=</tt> <tt class="py-string">'Invalid Value'</tt> </tt>
<a name="L389"></a><tt class="py-lineno">389</tt>  <tt class="py-line">                 </tt>
<a name="L390"></a><tt class="py-lineno">390</tt>  <tt class="py-line">                <tt class="py-comment"># For remaining bytes, determine if FAT 12, 16, or 32</tt> </tt>
<a name="L391"></a><tt class="py-lineno">391</tt>  <tt class="py-line">                <tt class="py-keyword">if</tt> <tt class="py-name">byt</tt><tt class="py-op">[</tt><tt class="py-number">17</tt><tt class="py-op">]</tt> <tt class="py-op">==</tt> <tt class="py-number">0</tt><tt class="py-op">:</tt> </tt>
<a name="L392"></a><tt class="py-lineno">392</tt>  <tt class="py-line">                        <tt class="py-comment"># FAT32</tt> </tt>
<a name="L393"></a><tt class="py-lineno">393</tt>  <tt class="py-line">                        <tt class="py-name">fat32data</tt> <tt class="py-op">=</tt> <tt class="py-op">(</tt><tt class="py-op">(</tt><tt class="py-string">'Sectors per FAT'</tt><tt class="py-op">,</tt> <tt class="py-number">36</tt><tt class="py-op">,</tt> <tt class="py-number">4</tt><tt class="py-op">,</tt> <tt class="py-string">'num'</tt><tt class="py-op">)</tt><tt class="py-op">,</tt> </tt>
<a name="L394"></a><tt class="py-lineno">394</tt>  <tt class="py-line">                        <tt class="py-op">(</tt><tt class="py-string">'Version'</tt><tt class="py-op">,</tt> <tt class="py-number">42</tt><tt class="py-op">,</tt> <tt class="py-number">2</tt><tt class="py-op">,</tt> <tt class="py-string">'num'</tt><tt class="py-op">)</tt><tt class="py-op">,</tt> </tt>
<a name="L395"></a><tt class="py-lineno">395</tt>  <tt class="py-line">                        <tt class="py-op">(</tt><tt class="py-string">'Cluster # of Root Dir'</tt><tt class="py-op">,</tt> <tt class="py-number">44</tt><tt class="py-op">,</tt> <tt class="py-number">4</tt><tt class="py-op">,</tt> <tt class="py-string">'num'</tt><tt class="py-op">)</tt><tt class="py-op">,</tt> </tt>
<a name="L396"></a><tt class="py-lineno">396</tt>  <tt class="py-line">                        <tt class="py-op">(</tt><tt class="py-string">'Sector # of FS Information'</tt><tt class="py-op">,</tt> <tt class="py-number">48</tt><tt class="py-op">,</tt> <tt class="py-number">2</tt><tt class="py-op">,</tt> <tt class="py-string">'num'</tt><tt class="py-op">)</tt><tt class="py-op">)</tt> </tt>
<a name="L397"></a><tt class="py-lineno">397</tt>  <tt class="py-line">                         </tt>
<a name="L398"></a><tt class="py-lineno">398</tt>  <tt class="py-line">                        <tt class="py-name">backupSec</tt> <tt class="py-op">=</tt> <tt id="link-54" class="py-name"><a title="Forensie.Hex2Dec" class="py-name" href="#" onclick="return doclink('link-54', 'Hex2Dec', 'link-28');">Hex2Dec</a></tt><tt class="py-op">(</tt><tt id="link-55" class="py-name"><a title="Forensie.StrFlatten" class="py-name" href="#" onclick="return doclink('link-55', 'StrFlatten', 'link-4');">StrFlatten</a></tt><tt class="py-op">(</tt><tt class="py-name">byt</tt><tt class="py-op">[</tt><tt class="py-number">50</tt><tt class="py-op">:</tt><tt class="py-number">50</tt><tt class="py-op">+</tt><tt class="py-number">2</tt><tt class="py-op">]</tt><tt class="py-op">)</tt><tt class="py-op">,</tt> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">endian</tt><tt class="py-op">)</tt> </tt>
<a name="L399"></a><tt class="py-lineno">399</tt>  <tt class="py-line">                        <tt class="py-keyword">if</tt> <tt class="py-name">backupSec</tt><tt class="py-op">:</tt> </tt>
<a name="L400"></a><tt class="py-lineno">400</tt>  <tt class="py-line">                                <tt class="py-name">fatInfo</tt><tt class="py-op">[</tt><tt class="py-string">'Sector # of Boot Sector Backup'</tt><tt class="py-op">]</tt> <tt class="py-op">=</tt> <tt class="py-name">backupSec</tt> </tt>
<a name="L401"></a><tt class="py-lineno">401</tt>  <tt class="py-line">                        <tt class="py-keyword">if</tt> <tt class="py-name">byt</tt><tt class="py-op">[</tt><tt class="py-number">64</tt><tt class="py-op">]</tt> <tt class="py-op">==</tt> <tt class="py-string">'00'</tt><tt class="py-op">:</tt> </tt>
<a name="L402"></a><tt class="py-lineno">402</tt>  <tt class="py-line">                                <tt class="py-name">fatInfo</tt><tt class="py-op">[</tt><tt class="py-string">'Drive Type'</tt><tt class="py-op">]</tt> <tt class="py-op">=</tt> <tt class="py-string">'Removable Media'</tt> </tt>
<a name="L403"></a><tt class="py-lineno">403</tt>  <tt class="py-line">                        <tt class="py-keyword">elif</tt> <tt class="py-name">byt</tt><tt class="py-op">[</tt><tt class="py-number">64</tt><tt class="py-op">]</tt> <tt class="py-op">==</tt> <tt class="py-string">'80'</tt><tt class="py-op">:</tt> </tt>
<a name="L404"></a><tt class="py-lineno">404</tt>  <tt class="py-line">                                <tt class="py-name">fatInfo</tt><tt class="py-op">[</tt><tt class="py-string">'Drive Type'</tt><tt class="py-op">]</tt> <tt class="py-op">=</tt> <tt class="py-string">'Hard Disk'</tt> </tt>
<a name="L405"></a><tt class="py-lineno">405</tt>  <tt class="py-line">                         </tt>
<a name="L406"></a><tt class="py-lineno">406</tt>  <tt class="py-line">                        <tt class="py-keyword">if</tt> <tt class="py-name">byt</tt><tt class="py-op">[</tt><tt class="py-number">66</tt><tt class="py-op">]</tt> <tt class="py-op">==</tt> <tt class="py-string">'29'</tt><tt class="py-op">:</tt> <tt class="py-comment"># Extended boot signature is valid</tt> </tt>
<a name="L407"></a><tt class="py-lineno">407</tt>  <tt class="py-line">                                <tt class="py-name">fat32data</tt> <tt class="py-op">=</tt> <tt class="py-name">fat32data</tt> <tt class="py-op">+</tt> <tt class="py-op">(</tt><tt class="py-op">(</tt><tt class="py-string">'Serial Number'</tt><tt class="py-op">,</tt> <tt class="py-number">67</tt><tt class="py-op">,</tt> <tt class="py-number">4</tt><tt class="py-op">,</tt> <tt class="py-string">'num'</tt><tt class="py-op">)</tt><tt class="py-op">,</tt> </tt>
<a name="L408"></a><tt class="py-lineno">408</tt>  <tt class="py-line">                                <tt class="py-op">(</tt><tt class="py-string">'Volume Label'</tt><tt class="py-op">,</tt> <tt class="py-number">71</tt><tt class="py-op">,</tt> <tt class="py-number">11</tt><tt class="py-op">,</tt> <tt class="py-string">'ascii'</tt><tt class="py-op">)</tt><tt class="py-op">,</tt> </tt>
<a name="L409"></a><tt class="py-lineno">409</tt>  <tt class="py-line">                                <tt class="py-op">(</tt><tt class="py-string">'File System Type'</tt><tt class="py-op">,</tt> <tt class="py-number">82</tt><tt class="py-op">,</tt> <tt class="py-number">8</tt><tt class="py-op">,</tt> <tt class="py-string">'ascii'</tt><tt class="py-op">)</tt><tt class="py-op">)</tt> </tt>
<a name="L410"></a><tt class="py-lineno">410</tt>  <tt class="py-line">                         </tt>
<a name="L411"></a><tt class="py-lineno">411</tt>  <tt class="py-line">                        <tt class="py-keyword">for</tt> <tt class="py-name">w</tt><tt class="py-op">,</tt> <tt class="py-name">x</tt><tt class="py-op">,</tt> <tt class="py-name">y</tt><tt class="py-op">,</tt> <tt class="py-name">z</tt> <tt class="py-keyword">in</tt> <tt class="py-name">fat32data</tt><tt class="py-op">:</tt> </tt>
<a name="L412"></a><tt class="py-lineno">412</tt>  <tt class="py-line">                                <tt class="py-name">self</tt><tt class="py-op">.</tt><tt id="link-56" class="py-name"><a title="Forensie.Forensie.AddFATInfo" class="py-name" href="#" onclick="return doclink('link-56', 'AddFATInfo', 'link-48');">AddFATInfo</a></tt><tt class="py-op">(</tt><tt class="py-name">fatInfo</tt><tt class="py-op">,</tt> <tt class="py-name">byt</tt><tt class="py-op">,</tt> <tt class="py-name">w</tt><tt class="py-op">,</tt> <tt class="py-name">x</tt><tt class="py-op">,</tt> <tt class="py-name">y</tt><tt class="py-op">,</tt> <tt class="py-name">z</tt><tt class="py-op">)</tt> </tt>
<a name="L413"></a><tt class="py-lineno">413</tt>  <tt class="py-line">                 </tt>
<a name="L414"></a><tt class="py-lineno">414</tt>  <tt class="py-line">                <tt class="py-keyword">else</tt><tt class="py-op">:</tt> </tt>
<a name="L415"></a><tt class="py-lineno">415</tt>  <tt class="py-line">                        <tt class="py-comment"># Process FAT12 and FAT16 the same way</tt> </tt>
<a name="L416"></a><tt class="py-lineno">416</tt>  <tt class="py-line">                        <tt class="py-name">fat16data</tt> <tt class="py-op">=</tt> <tt class="py-op">(</tt><tt class="py-op">(</tt><tt class="py-string">'Max Root Directories'</tt><tt class="py-op">,</tt> <tt class="py-number">17</tt><tt class="py-op">,</tt> <tt class="py-number">2</tt><tt class="py-op">,</tt> <tt class="py-string">'num'</tt><tt class="py-op">)</tt><tt class="py-op">,</tt> <tt class="py-op">(</tt><tt class="py-string">'Sectors per FAT'</tt><tt class="py-op">,</tt> <tt class="py-number">22</tt><tt class="py-op">,</tt> <tt class="py-number">2</tt><tt class="py-op">,</tt> <tt class="py-string">'num'</tt><tt class="py-op">)</tt><tt class="py-op">)</tt> </tt>
<a name="L417"></a><tt class="py-lineno">417</tt>  <tt class="py-line">                         </tt>
<a name="L418"></a><tt class="py-lineno">418</tt>  <tt class="py-line">                        <tt class="py-keyword">if</tt> <tt class="py-name">byt</tt><tt class="py-op">[</tt><tt class="py-number">36</tt><tt class="py-op">]</tt> <tt class="py-op">==</tt> <tt class="py-string">'00'</tt><tt class="py-op">:</tt> </tt>
<a name="L419"></a><tt class="py-lineno">419</tt>  <tt class="py-line">                                <tt class="py-name">fatInfo</tt><tt class="py-op">[</tt><tt class="py-string">'Drive Type'</tt><tt class="py-op">]</tt> <tt class="py-op">=</tt> <tt class="py-string">'Removable Media'</tt> </tt>
<a name="L420"></a><tt class="py-lineno">420</tt>  <tt class="py-line">                        <tt class="py-keyword">elif</tt> <tt class="py-name">byt</tt><tt class="py-op">[</tt><tt class="py-number">36</tt><tt class="py-op">]</tt> <tt class="py-op">==</tt> <tt class="py-string">'80'</tt><tt class="py-op">:</tt> </tt>
<a name="L421"></a><tt class="py-lineno">421</tt>  <tt class="py-line">                                <tt class="py-name">fatInfo</tt><tt class="py-op">[</tt><tt class="py-string">'Drive Type'</tt><tt class="py-op">]</tt> <tt class="py-op">=</tt> <tt class="py-string">'Hard Disk'</tt> </tt>
<a name="L422"></a><tt class="py-lineno">422</tt>  <tt class="py-line">                         </tt>
<a name="L423"></a><tt class="py-lineno">423</tt>  <tt class="py-line">                        <tt class="py-keyword">if</tt> <tt class="py-name">byt</tt><tt class="py-op">[</tt><tt class="py-number">38</tt><tt class="py-op">]</tt> <tt class="py-op">==</tt> <tt class="py-string">'29'</tt><tt class="py-op">:</tt> <tt class="py-comment"># Extended boot signature is valid</tt> </tt>
<a name="L424"></a><tt class="py-lineno">424</tt>  <tt class="py-line">                                <tt class="py-name">fat16data</tt> <tt class="py-op">=</tt> <tt class="py-name">fat16data</tt> <tt class="py-op">+</tt> <tt class="py-op">(</tt><tt class="py-op">(</tt><tt class="py-string">'Serial Number'</tt><tt class="py-op">,</tt> <tt class="py-number">39</tt><tt class="py-op">,</tt> <tt class="py-number">4</tt><tt class="py-op">,</tt> <tt class="py-string">'num'</tt><tt class="py-op">)</tt><tt class="py-op">,</tt> </tt>
<a name="L425"></a><tt class="py-lineno">425</tt>  <tt class="py-line">                                <tt class="py-op">(</tt><tt class="py-string">'Volume Label'</tt><tt class="py-op">,</tt> <tt class="py-number">43</tt><tt class="py-op">,</tt> <tt class="py-number">11</tt><tt class="py-op">,</tt> <tt class="py-string">'ascii'</tt><tt class="py-op">)</tt><tt class="py-op">,</tt> </tt>
<a name="L426"></a><tt class="py-lineno">426</tt>  <tt class="py-line">                                <tt class="py-op">(</tt><tt class="py-string">'File System Type'</tt><tt class="py-op">,</tt> <tt class="py-number">54</tt><tt class="py-op">,</tt> <tt class="py-number">8</tt><tt class="py-op">,</tt> <tt class="py-string">'ascii'</tt><tt class="py-op">)</tt><tt class="py-op">)</tt> </tt>
<a name="L427"></a><tt class="py-lineno">427</tt>  <tt class="py-line">                                <tt class="py-keyword">for</tt> <tt class="py-name">w</tt><tt class="py-op">,</tt> <tt class="py-name">x</tt><tt class="py-op">,</tt> <tt class="py-name">y</tt><tt class="py-op">,</tt> <tt class="py-name">z</tt> <tt class="py-keyword">in</tt> <tt class="py-name">fat16data</tt><tt class="py-op">:</tt> </tt>
<a name="L428"></a><tt class="py-lineno">428</tt>  <tt class="py-line">                                        <tt class="py-name">self</tt><tt class="py-op">.</tt><tt id="link-57" class="py-name"><a title="Forensie.Forensie.AddFATInfo" class="py-name" href="#" onclick="return doclink('link-57', 'AddFATInfo', 'link-48');">AddFATInfo</a></tt><tt class="py-op">(</tt><tt class="py-name">fatInfo</tt><tt class="py-op">,</tt> <tt class="py-name">byt</tt><tt class="py-op">,</tt> <tt class="py-name">w</tt><tt class="py-op">,</tt> <tt class="py-name">x</tt><tt class="py-op">,</tt> <tt class="py-name">y</tt><tt class="py-op">,</tt> <tt class="py-name">z</tt><tt class="py-op">)</tt> </tt>
<a name="L429"></a><tt class="py-lineno">429</tt>  <tt class="py-line">                <tt class="py-keyword">return</tt> <tt class="py-name">fatInfo</tt> </tt>
</div><a name="L430"></a><tt class="py-lineno">430</tt>  <tt class="py-line">         </tt>
<a name="Forensie.AddFATInfo"></a><div id="Forensie.AddFATInfo-def"><a name="L431"></a><tt class="py-lineno">431</tt> <a class="py-toggle" href="#" id="Forensie.AddFATInfo-toggle" onclick="return toggle('Forensie.AddFATInfo');">-</a><tt class="py-line">        <tt class="py-keyword">def</tt> <a class="py-def-name" href="Forensie.Forensie-class.html#AddFATInfo">AddFATInfo</a><tt class="py-op">(</tt><tt class="py-param">self</tt><tt class="py-op">,</tt> <tt class="py-param">obj</tt><tt class="py-op">,</tt> <tt class="py-param">byt</tt><tt class="py-op">,</tt> <tt class="py-param">label</tt><tt class="py-op">,</tt> <tt class="py-param">off</tt><tt class="py-op">,</tt> <tt class="py-param">olen</tt><tt class="py-op">,</tt> <tt class="py-param">dtype</tt><tt class="py-op">)</tt><tt class="py-op">:</tt> </tt>
</div><div id="Forensie.AddFATInfo-collapsed" style="display:none;" pad="+++" indent="++++++++++++"></div><div id="Forensie.AddFATInfo-expanded"><a name="L432"></a><tt class="py-lineno">432</tt>  <tt class="py-line">                <tt class="py-docstring">"""To simplify the commands in GetFATInfo(), this method accepts a </tt> </tt>
<a name="L433"></a><tt class="py-lineno">433</tt>  <tt class="py-line"><tt class="py-docstring">                dictionary object, the bytes from the VBR, the string to be the </tt> </tt>
<a name="L434"></a><tt class="py-lineno">434</tt>  <tt class="py-line"><tt class="py-docstring">                dictionary key, the byte offset of the data, the length of the data,</tt> </tt>
<a name="L435"></a><tt class="py-lineno">435</tt>  <tt class="py-line"><tt class="py-docstring">                and the data type which should be either 'ascii' or 'num'. No </tt> </tt>
<a name="L436"></a><tt class="py-lineno">436</tt>  <tt class="py-line"><tt class="py-docstring">                return value because the dictionary is added to directly.</tt> </tt>
<a name="L437"></a><tt class="py-lineno">437</tt>  <tt class="py-line"><tt class="py-docstring">                """</tt> </tt>
<a name="L438"></a><tt class="py-lineno">438</tt>  <tt class="py-line">                <tt class="py-keyword">if</tt> <tt class="py-name">dtype</tt> <tt class="py-op">==</tt> <tt class="py-string">'ascii'</tt><tt class="py-op">:</tt> </tt>
<a name="L439"></a><tt class="py-lineno">439</tt>  <tt class="py-line">                        <tt class="py-name">obj</tt><tt class="py-op">[</tt><tt class="py-name">label</tt><tt class="py-op">]</tt> <tt class="py-op">=</tt> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt id="link-58" class="py-name"><a title="Forensie.Forensie.DecodeHex" class="py-name" href="#" onclick="return doclink('link-58', 'DecodeHex', 'link-11');">DecodeHex</a></tt><tt class="py-op">(</tt><tt id="link-59" class="py-name"><a title="Forensie.StrFlatten" class="py-name" href="#" onclick="return doclink('link-59', 'StrFlatten', 'link-4');">StrFlatten</a></tt><tt class="py-op">(</tt><tt class="py-name">byt</tt><tt class="py-op">[</tt><tt class="py-name">off</tt><tt class="py-op">:</tt><tt class="py-name">off</tt><tt class="py-op">+</tt><tt class="py-name">olen</tt><tt class="py-op">]</tt><tt class="py-op">)</tt><tt class="py-op">,</tt> <tt class="py-name">float</tt><tt class="py-op">(</tt><tt class="py-string">'inf'</tt><tt class="py-op">)</tt><tt class="py-op">,</tt> <tt class="py-name">False</tt><tt class="py-op">)</tt> </tt>
<a name="L440"></a><tt class="py-lineno">440</tt>  <tt class="py-line">                <tt class="py-keyword">elif</tt> <tt class="py-name">dtype</tt> <tt class="py-op">==</tt> <tt class="py-string">'num'</tt><tt class="py-op">:</tt> </tt>
<a name="L441"></a><tt class="py-lineno">441</tt>  <tt class="py-line">                        <tt class="py-name">obj</tt><tt class="py-op">[</tt><tt class="py-name">label</tt><tt class="py-op">]</tt> <tt class="py-op">=</tt> <tt id="link-60" class="py-name"><a title="Forensie.Hex2Dec" class="py-name" href="#" onclick="return doclink('link-60', 'Hex2Dec', 'link-28');">Hex2Dec</a></tt><tt class="py-op">(</tt><tt id="link-61" class="py-name"><a title="Forensie.StrFlatten" class="py-name" href="#" onclick="return doclink('link-61', 'StrFlatten', 'link-4');">StrFlatten</a></tt><tt class="py-op">(</tt><tt class="py-name">byt</tt><tt class="py-op">[</tt><tt class="py-name">off</tt><tt class="py-op">:</tt><tt class="py-name">off</tt><tt class="py-op">+</tt><tt class="py-name">olen</tt><tt class="py-op">]</tt><tt class="py-op">)</tt><tt class="py-op">,</tt> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">endian</tt><tt class="py-op">)</tt> </tt>
<a name="L442"></a><tt class="py-lineno">442</tt>  <tt class="py-line">                <tt class="py-keyword">else</tt><tt class="py-op">:</tt> </tt>
<a name="L443"></a><tt class="py-lineno">443</tt>  <tt class="py-line">                        <tt class="py-keyword">raise</tt> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt id="link-62" class="py-name"><a title="Forensie.Forensie.FormatError" class="py-name" href="#" onclick="return doclink('link-62', 'FormatError', 'link-9');">FormatError</a></tt><tt class="py-op">(</tt><tt class="py-string">"Invalid data type passed to AddFATInfo: %s, expected 'ascii' or 'num'"</tt> <tt class="py-op">%</tt> <tt class="py-name">dtype</tt><tt class="py-op">)</tt> </tt>
</div><a name="L444"></a><tt class="py-lineno">444</tt>  <tt class="py-line">         </tt>
<a name="Forensie.FormatFATInfo"></a><div id="Forensie.FormatFATInfo-def"><a name="L445"></a><tt class="py-lineno">445</tt> <a class="py-toggle" href="#" id="Forensie.FormatFATInfo-toggle" onclick="return toggle('Forensie.FormatFATInfo');">-</a><tt class="py-line">        <tt class="py-keyword">def</tt> <a class="py-def-name" href="Forensie.Forensie-class.html#FormatFATInfo">FormatFATInfo</a><tt class="py-op">(</tt><tt class="py-param">self</tt><tt class="py-op">,</tt> <tt class="py-param">info</tt><tt class="py-op">)</tt><tt class="py-op">:</tt> </tt>
</div><div id="Forensie.FormatFATInfo-collapsed" style="display:none;" pad="+++" indent="++++++++++++"></div><div id="Forensie.FormatFATInfo-expanded"><a name="L446"></a><tt class="py-lineno">446</tt>  <tt class="py-line">                <tt class="py-docstring">"""Puts all the data from the dictionary info into a string for </tt> </tt>
<a name="L447"></a><tt class="py-lineno">447</tt>  <tt class="py-line"><tt class="py-docstring">                printing. The categories are defined in a local tuple and looped </tt> </tt>
<a name="L448"></a><tt class="py-lineno">448</tt>  <tt class="py-line"><tt class="py-docstring">                through. All categories that do not exist in info are skipped.</tt> </tt>
<a name="L449"></a><tt class="py-lineno">449</tt>  <tt class="py-line"><tt class="py-docstring">                </tt> </tt>
<a name="L450"></a><tt class="py-lineno">450</tt>  <tt class="py-line"><tt class="py-docstring">                Returns the string for printing.</tt> </tt>
<a name="L451"></a><tt class="py-lineno">451</tt>  <tt class="py-line"><tt class="py-docstring">                """</tt> </tt>
<a name="L452"></a><tt class="py-lineno">452</tt>  <tt class="py-line">                <tt class="py-name">cats</tt> <tt class="py-op">=</tt> <tt class="py-op">(</tt><tt class="py-string">'OEM Name'</tt><tt class="py-op">,</tt> <tt class="py-string">'Volume Label'</tt><tt class="py-op">,</tt> <tt class="py-string">'Drive Type'</tt><tt class="py-op">,</tt> <tt class="py-string">'Media Descriptor'</tt><tt class="py-op">,</tt> <tt class="py-string">'File System Type'</tt><tt class="py-op">,</tt> <tt class="py-string">'Bytes per Sector'</tt><tt class="py-op">,</tt> <tt class="py-string">'Sectors per Cluster'</tt><tt class="py-op">,</tt> <tt class="py-string">'Sectors per track'</tt><tt class="py-op">,</tt> <tt class="py-string">'Number of Heads'</tt><tt class="py-op">,</tt> <tt class="py-string">'Total Sectors'</tt><tt class="py-op">,</tt> <tt class="py-string">'Hidden Sectors Preceeding'</tt><tt class="py-op">,</tt> <tt class="py-string">'Reserved Sector Count'</tt><tt class="py-op">,</tt> <tt class="py-string">'Sectors per FAT'</tt><tt class="py-op">,</tt> <tt class="py-string">'Number of FATs'</tt><tt class="py-op">,</tt> <tt class="py-string">'Cluster # of Root Dir'</tt><tt class="py-op">,</tt> <tt class="py-string">'Max Root Directories'</tt><tt class="py-op">,</tt> <tt class="py-string">'Sector # of FS Information'</tt><tt class="py-op">,</tt> <tt class="py-string">'Sector # of Boot Sector Backup'</tt><tt class="py-op">,</tt> <tt class="py-string">'Version'</tt><tt class="py-op">)</tt> </tt>
<a name="L453"></a><tt class="py-lineno">453</tt>  <tt class="py-line">                <tt class="py-name">end</tt> <tt class="py-op">=</tt> <tt class="py-string">'Translation of FAT VBR:\n\n'</tt> </tt>
<a name="L454"></a><tt class="py-lineno">454</tt>  <tt class="py-line">                 </tt>
<a name="L455"></a><tt class="py-lineno">455</tt>  <tt class="py-line">                <tt class="py-keyword">for</tt> <tt class="py-name">cat</tt> <tt class="py-keyword">in</tt> <tt class="py-name">cats</tt><tt class="py-op">:</tt> </tt>
<a name="L456"></a><tt class="py-lineno">456</tt>  <tt class="py-line">                        <tt class="py-keyword">try</tt><tt class="py-op">:</tt> </tt>
<a name="L457"></a><tt class="py-lineno">457</tt>  <tt class="py-line">                                <tt class="py-name">end</tt> <tt class="py-op">+=</tt> <tt class="py-string">'%s: %s\n'</tt> <tt class="py-op">%</tt> <tt class="py-op">(</tt><tt class="py-name">cat</tt><tt class="py-op">,</tt> <tt class="py-name">info</tt><tt class="py-op">[</tt><tt class="py-name">cat</tt><tt class="py-op">]</tt><tt class="py-op">)</tt> </tt>
<a name="L458"></a><tt class="py-lineno">458</tt>  <tt class="py-line">                        <tt class="py-keyword">except</tt> <tt class="py-name">KeyError</tt><tt class="py-op">:</tt> </tt>
<a name="L459"></a><tt class="py-lineno">459</tt>  <tt class="py-line">                                <tt class="py-keyword">continue</tt> </tt>
<a name="L460"></a><tt class="py-lineno">460</tt>  <tt class="py-line">                <tt class="py-keyword">return</tt> <tt class="py-name">end</tt> </tt>
</div><a name="L461"></a><tt class="py-lineno">461</tt>  <tt class="py-line">         </tt>
<a name="Forensie.GetCHS"></a><div id="Forensie.GetCHS-def"><a name="L462"></a><tt class="py-lineno">462</tt> <a class="py-toggle" href="#" id="Forensie.GetCHS-toggle" onclick="return toggle('Forensie.GetCHS');">-</a><tt class="py-line">        <tt class="py-keyword">def</tt> <a class="py-def-name" href="Forensie.Forensie-class.html#GetCHS">GetCHS</a><tt class="py-op">(</tt><tt class="py-param">self</tt><tt class="py-op">,</tt> <tt class="py-param">entry</tt><tt class="py-op">,</tt> <tt class="py-param">end</tt><tt class="py-op">=</tt><tt class="py-name">False</tt><tt class="py-op">)</tt><tt class="py-op">:</tt> </tt>
</div><div id="Forensie.GetCHS-collapsed" style="display:none;" pad="+++" indent="++++++++++++"></div><div id="Forensie.GetCHS-expanded"><a name="L463"></a><tt class="py-lineno">463</tt>  <tt class="py-line">                <tt class="py-docstring">"""Retrieves the Cylinder Head Sector address from an MBR partition </tt> </tt>
<a name="L464"></a><tt class="py-lineno">464</tt>  <tt class="py-line"><tt class="py-docstring">                table entry. Since both the start CHS and end CHS are calculated </tt> </tt>
<a name="L465"></a><tt class="py-lineno">465</tt>  <tt class="py-line"><tt class="py-docstring">                the same way, if end is True, the offset will be changed so the </tt> </tt>
<a name="L466"></a><tt class="py-lineno">466</tt>  <tt class="py-line"><tt class="py-docstring">                proper values are put into the calculation.</tt> </tt>
<a name="L467"></a><tt class="py-lineno">467</tt>  <tt class="py-line"><tt class="py-docstring">                </tt> </tt>
<a name="L468"></a><tt class="py-lineno">468</tt>  <tt class="py-line"><tt class="py-docstring">                Returns a tuple in the form (head, cylinder, sector).</tt> </tt>
<a name="L469"></a><tt class="py-lineno">469</tt>  <tt class="py-line"><tt class="py-docstring">                """</tt> </tt>
<a name="L470"></a><tt class="py-lineno">470</tt>  <tt class="py-line">                <tt class="py-keyword">if</tt> <tt class="py-keyword">not</tt> <tt class="py-name">end</tt><tt class="py-op">:</tt> </tt>
<a name="L471"></a><tt class="py-lineno">471</tt>  <tt class="py-line">                        <tt class="py-name">h</tt><tt class="py-op">,</tt> <tt class="py-name">c</tt><tt class="py-op">,</tt> <tt class="py-name">s</tt> <tt class="py-op">=</tt> <tt class="py-number">1</tt><tt class="py-op">,</tt> <tt class="py-number">2</tt><tt class="py-op">,</tt> <tt class="py-number">3</tt> </tt>
<a name="L472"></a><tt class="py-lineno">472</tt>  <tt class="py-line">                <tt class="py-keyword">else</tt><tt class="py-op">:</tt> </tt>
<a name="L473"></a><tt class="py-lineno">473</tt>  <tt class="py-line">                        <tt class="py-name">h</tt><tt class="py-op">,</tt> <tt class="py-name">c</tt><tt class="py-op">,</tt> <tt class="py-name">s</tt> <tt class="py-op">=</tt> <tt class="py-number">5</tt><tt class="py-op">,</tt> <tt class="py-number">6</tt><tt class="py-op">,</tt> <tt class="py-number">7</tt> </tt>
<a name="L474"></a><tt class="py-lineno">474</tt>  <tt class="py-line">                <tt class="py-name">cyl</tt> <tt class="py-op">=</tt> <tt class="py-name">int</tt><tt class="py-op">(</tt><tt class="py-name">entry</tt><tt class="py-op">[</tt><tt class="py-name">c</tt><tt class="py-op">]</tt><tt class="py-op">,</tt> <tt class="py-number">16</tt><tt class="py-op">)</tt><tt class="py-op">&amp;</tt><tt class="py-number">0xc0</tt><tt class="py-op">*</tt><tt class="py-number">4</tt> <tt class="py-op">+</tt> <tt class="py-name">int</tt><tt class="py-op">(</tt><tt class="py-name">entry</tt><tt class="py-op">[</tt><tt class="py-name">s</tt><tt class="py-op">]</tt><tt class="py-op">,</tt> <tt class="py-number">16</tt><tt class="py-op">)</tt> </tt>
<a name="L475"></a><tt class="py-lineno">475</tt>  <tt class="py-line">                <tt class="py-name">sec</tt> <tt class="py-op">=</tt> <tt class="py-name">int</tt><tt class="py-op">(</tt><tt class="py-name">entry</tt><tt class="py-op">[</tt><tt class="py-name">s</tt><tt class="py-op">]</tt><tt class="py-op">,</tt> <tt class="py-number">16</tt><tt class="py-op">)</tt><tt class="py-op">&amp;</tt><tt class="py-number">0x3f</tt> </tt>
<a name="L476"></a><tt class="py-lineno">476</tt>  <tt class="py-line">                <tt class="py-keyword">return</tt> <tt class="py-op">(</tt><tt class="py-name">int</tt><tt class="py-op">(</tt><tt class="py-name">entry</tt><tt class="py-op">[</tt><tt class="py-name">h</tt><tt class="py-op">]</tt><tt class="py-op">,</tt> <tt class="py-number">16</tt><tt class="py-op">)</tt><tt class="py-op">,</tt> <tt class="py-name">cyl</tt><tt class="py-op">,</tt> <tt class="py-name">sec</tt><tt class="py-op">)</tt> </tt>
</div><a name="L477"></a><tt class="py-lineno">477</tt>  <tt class="py-line"> </tt>
<a name="Forensie.GetBytes"></a><div id="Forensie.GetBytes-def"><a name="L478"></a><tt class="py-lineno">478</tt> <a class="py-toggle" href="#" id="Forensie.GetBytes-toggle" onclick="return toggle('Forensie.GetBytes');">-</a><tt class="py-line">        <tt class="py-keyword">def</tt> <a class="py-def-name" href="Forensie.Forensie-class.html#GetBytes">GetBytes</a><tt class="py-op">(</tt><tt class="py-param">self</tt><tt class="py-op">,</tt> <tt class="py-param">row</tt><tt class="py-op">,</tt> <tt class="py-param">width</tt><tt class="py-op">,</tt> <tt class="py-param">hexstr</tt><tt class="py-op">=</tt><tt class="py-name">None</tt><tt class="py-op">)</tt><tt class="py-op">:</tt> </tt>
</div><div id="Forensie.GetBytes-collapsed" style="display:none;" pad="+++" indent="++++++++++++"></div><div id="Forensie.GetBytes-expanded"><a name="L479"></a><tt class="py-lineno">479</tt>  <tt class="py-line">                <tt class="py-docstring">"""Returns a string of the hex bytes from the input string for the </tt> </tt>
<a name="L480"></a><tt class="py-lineno">480</tt>  <tt class="py-line"><tt class="py-docstring">                given row and width. Separates the bytes with a space.</tt> </tt>
<a name="L481"></a><tt class="py-lineno">481</tt>  <tt class="py-line"><tt class="py-docstring">                """</tt> </tt>
<a name="L482"></a><tt class="py-lineno">482</tt>  <tt class="py-line">                <tt class="py-keyword">if</tt> <tt class="py-name">hexstr</tt> <tt class="py-op">==</tt> <tt class="py-name">None</tt><tt class="py-op">:</tt> </tt>
<a name="L483"></a><tt class="py-lineno">483</tt>  <tt class="py-line">                        <tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">bytes</tt> <tt class="py-op">=</tt> <tt id="link-63" class="py-name"><a title="Forensie.ChopHexStr" class="py-name" href="#" onclick="return doclink('link-63', 'ChopHexStr', 'link-21');">ChopHexStr</a></tt><tt class="py-op">(</tt><tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">inputStr</tt><tt class="py-op">)</tt> <tt class="py-comment"># Make sure we have the input string parsed into bytes</tt> </tt>
<a name="L484"></a><tt class="py-lineno">484</tt>  <tt class="py-line">                <tt class="py-keyword">else</tt><tt class="py-op">:</tt> </tt>
<a name="L485"></a><tt class="py-lineno">485</tt>  <tt class="py-line">                        <tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">bytes</tt> <tt class="py-op">=</tt> <tt id="link-64" class="py-name"><a title="Forensie.ChopHexStr" class="py-name" href="#" onclick="return doclink('link-64', 'ChopHexStr', 'link-21');">ChopHexStr</a></tt><tt class="py-op">(</tt><tt class="py-name">hexstr</tt><tt class="py-op">)</tt> </tt>
<a name="L486"></a><tt class="py-lineno">486</tt>  <tt class="py-line">                <tt class="py-name">end</tt> <tt class="py-op">=</tt> <tt class="py-string">''</tt> </tt>
<a name="L487"></a><tt class="py-lineno">487</tt>  <tt class="py-line">                <tt class="py-keyword">for</tt> <tt class="py-name">byte</tt> <tt class="py-keyword">in</tt> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">bytes</tt><tt class="py-op">[</tt><tt class="py-name">row</tt><tt class="py-op">*</tt><tt class="py-name">width</tt><tt class="py-op">:</tt><tt class="py-op">(</tt><tt class="py-name">row</tt><tt class="py-op">+</tt><tt class="py-number">1</tt><tt class="py-op">)</tt><tt class="py-op">*</tt><tt class="py-name">width</tt><tt class="py-op">]</tt><tt class="py-op">:</tt> </tt>
<a name="L488"></a><tt class="py-lineno">488</tt>  <tt class="py-line">                        <tt class="py-name">end</tt> <tt class="py-op">+=</tt> <tt class="py-string">'%s '</tt> <tt class="py-op">%</tt> <tt class="py-name">byte</tt> </tt>
<a name="L489"></a><tt class="py-lineno">489</tt>  <tt class="py-line">                <tt class="py-keyword">return</tt> <tt class="py-name">end</tt><tt class="py-op">[</tt><tt class="py-op">:</tt><tt class="py-op">-</tt><tt class="py-number">1</tt><tt class="py-op">]</tt><tt class="py-op">.</tt><tt class="py-name">ljust</tt><tt class="py-op">(</tt><tt class="py-name">width</tt><tt class="py-op">*</tt><tt class="py-number">3</tt><tt class="py-op">-</tt><tt class="py-number">1</tt><tt class="py-op">)</tt> <tt class="py-comment"># Take off last space before returning, make same width as other rows</tt> </tt>
</div><a name="L490"></a><tt class="py-lineno">490</tt>  <tt class="py-line">         </tt>
<a name="Forensie.DecodeHex"></a><div id="Forensie.DecodeHex-def"><a name="L491"></a><tt class="py-lineno">491</tt> <a class="py-toggle" href="#" id="Forensie.DecodeHex-toggle" onclick="return toggle('Forensie.DecodeHex');">-</a><tt class="py-line">        <tt class="py-keyword">def</tt> <a class="py-def-name" href="Forensie.Forensie-class.html#DecodeHex">DecodeHex</a><tt class="py-op">(</tt><tt class="py-param">self</tt><tt class="py-op">,</tt> <tt class="py-param">numstr</tt><tt class="py-op">=</tt><tt class="py-name">None</tt><tt class="py-op">,</tt> <tt class="py-param">width</tt><tt class="py-op">=</tt><tt class="py-number">16</tt><tt class="py-op">,</tt> <tt class="py-param">pretty</tt><tt class="py-op">=</tt><tt class="py-name">True</tt><tt class="py-op">)</tt><tt class="py-op">:</tt> </tt>
</div><div id="Forensie.DecodeHex-collapsed" style="display:none;" pad="+++" indent="++++++++++++"></div><div id="Forensie.DecodeHex-expanded"><a name="L492"></a><tt class="py-lineno">492</tt>  <tt class="py-line">                <tt class="py-docstring">"""Returns the decoded hex string of numstr with newlines after width </tt> </tt>
<a name="L493"></a><tt class="py-lineno">493</tt>  <tt class="py-line"><tt class="py-docstring">                characters. Replaces any non-printing characters with a period. If </tt> </tt>
<a name="L494"></a><tt class="py-lineno">494</tt>  <tt class="py-line"><tt class="py-docstring">                width is infinity, no newline characters are inserted. If pretty is </tt> </tt>
<a name="L495"></a><tt class="py-lineno">495</tt>  <tt class="py-line"><tt class="py-docstring">                True (default), the hex byte offset is printed in a column to the </tt> </tt>
<a name="L496"></a><tt class="py-lineno">496</tt>  <tt class="py-line"><tt class="py-docstring">                left, the hex bytes are printed in a center column, the ASCII </tt> </tt>
<a name="L497"></a><tt class="py-lineno">497</tt>  <tt class="py-line"><tt class="py-docstring">                decoding is in a column on the right, and a header with labels for </tt> </tt>
<a name="L498"></a><tt class="py-lineno">498</tt>  <tt class="py-line"><tt class="py-docstring">                the first two columns are all added to the string.</tt> </tt>
<a name="L499"></a><tt class="py-lineno">499</tt>  <tt class="py-line"><tt class="py-docstring">                """</tt> </tt>
<a name="L500"></a><tt class="py-lineno">500</tt>  <tt class="py-line">                <tt class="py-keyword">from</tt> <tt class="py-name">math</tt> <tt class="py-keyword">import</tt> <tt class="py-name">ceil</tt><tt class="py-op">,</tt> <tt class="py-name">log</tt> </tt>
<a name="L501"></a><tt class="py-lineno">501</tt>  <tt class="py-line">                <tt class="py-keyword">if</tt> <tt class="py-name">numstr</tt> <tt class="py-op">==</tt> <tt class="py-name">None</tt><tt class="py-op">:</tt> <tt class="py-name">numstr</tt> <tt class="py-op">=</tt> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">inputStr</tt> </tt>
<a name="L502"></a><tt class="py-lineno">502</tt>  <tt class="py-line">                <tt class="py-name">tmp</tt> <tt class="py-op">=</tt> <tt class="py-string">''</tt> </tt>
<a name="L503"></a><tt class="py-lineno">503</tt>  <tt class="py-line">                <tt class="py-keyword">for</tt> <tt class="py-name">ch</tt> <tt class="py-keyword">in</tt> <tt class="py-name">numstr</tt><tt class="py-op">.</tt><tt class="py-name">decode</tt><tt class="py-op">(</tt><tt class="py-string">'hex'</tt><tt class="py-op">)</tt><tt class="py-op">:</tt> </tt>
<a name="L504"></a><tt class="py-lineno">504</tt>  <tt class="py-line">                        <tt class="py-name">tmp2</tt> <tt class="py-op">=</tt> <tt class="py-name">sub</tt><tt class="py-op">(</tt><tt class="py-string">r'\\x..'</tt><tt class="py-op">,</tt> <tt class="py-string">'.'</tt><tt class="py-op">,</tt> <tt class="py-name">repr</tt><tt class="py-op">(</tt><tt class="py-name">ch</tt><tt class="py-op">)</tt><tt class="py-op">[</tt><tt class="py-number">1</tt><tt class="py-op">:</tt><tt class="py-op">-</tt><tt class="py-number">1</tt><tt class="py-op">]</tt><tt class="py-op">)</tt> </tt>
<a name="L505"></a><tt class="py-lineno">505</tt>  <tt class="py-line">                        <tt class="py-keyword">if</tt> <tt class="py-name">len</tt><tt class="py-op">(</tt><tt class="py-name">tmp2</tt><tt class="py-op">)</tt> <tt class="py-op">==</tt> <tt class="py-number">1</tt><tt class="py-op">:</tt> <tt class="py-name">tmp</tt> <tt class="py-op">+=</tt> <tt class="py-name">tmp2</tt> </tt>
<a name="L506"></a><tt class="py-lineno">506</tt>  <tt class="py-line">                        <tt class="py-keyword">else</tt><tt class="py-op">:</tt> <tt class="py-name">tmp</tt> <tt class="py-op">+=</tt> <tt class="py-string">'.'</tt> </tt>
<a name="L507"></a><tt class="py-lineno">507</tt>  <tt class="py-line">                 </tt>
<a name="L508"></a><tt class="py-lineno">508</tt>  <tt class="py-line">                <tt class="py-keyword">if</tt> <tt class="py-name">pretty</tt><tt class="py-op">:</tt> <tt class="py-comment"># Does a 'pretty print' of the decoded values</tt> </tt>
<a name="L509"></a><tt class="py-lineno">509</tt>  <tt class="py-line">                        <tt class="py-name">strLength</tt> <tt class="py-op">=</tt> <tt class="py-name">len</tt><tt class="py-op">(</tt><tt class="py-name">tmp</tt><tt class="py-op">)</tt> </tt>
<a name="L510"></a><tt class="py-lineno">510</tt>  <tt class="py-line">                        <tt class="py-name">offsetWidth</tt> <tt class="py-op">=</tt> <tt class="py-name">max</tt><tt class="py-op">(</tt><tt class="py-name">int</tt><tt class="py-op">(</tt><tt class="py-name">ceil</tt><tt class="py-op">(</tt><tt class="py-name">log</tt><tt class="py-op">(</tt><tt class="py-name">strLength</tt><tt class="py-op">,</tt> <tt class="py-name">width</tt><tt class="py-op">)</tt><tt class="py-op">)</tt><tt class="py-op">)</tt><tt class="py-op">,</tt> <tt class="py-number">4</tt><tt class="py-op">)</tt> <tt class="py-comment"># At least 4, otherwise log</tt> </tt>
<a name="L511"></a><tt class="py-lineno">511</tt>  <tt class="py-line">                         </tt>
<a name="L512"></a><tt class="py-lineno">512</tt>  <tt class="py-line">                        <tt class="py-name">byteOffs</tt> <tt class="py-op">=</tt> <tt class="py-string">''</tt> </tt>
<a name="L513"></a><tt class="py-lineno">513</tt>  <tt class="py-line">                        <tt class="py-keyword">for</tt> <tt class="py-name">x</tt> <tt class="py-keyword">in</tt> <tt class="py-name">xrange</tt><tt class="py-op">(</tt><tt class="py-name">width</tt><tt class="py-op">)</tt><tt class="py-op">:</tt> </tt>
<a name="L514"></a><tt class="py-lineno">514</tt>  <tt class="py-line">                                <tt class="py-name">byteOffs</tt> <tt class="py-op">+=</tt> <tt class="py-op">(</tt><tt class="py-string">'%02x'</tt> <tt class="py-op">%</tt> <tt class="py-name">x</tt><tt class="py-op">)</tt><tt class="py-op">.</tt><tt class="py-name">upper</tt><tt class="py-op">(</tt><tt class="py-op">)</tt> </tt>
<a name="L515"></a><tt class="py-lineno">515</tt>  <tt class="py-line">                         </tt>
<a name="L516"></a><tt class="py-lineno">516</tt>  <tt class="py-line">                        <tt class="py-name">end</tt> <tt class="py-op">=</tt> <tt class="py-string">'\n\n%s  %s\n%s %s %s\n'</tt> <tt class="py-op">%</tt> <tt class="py-op">(</tt><tt class="py-string">'Offset'</tt><tt class="py-op">.</tt><tt class="py-name">center</tt><tt class="py-op">(</tt><tt class="py-name">offsetWidth</tt><tt class="py-op">+</tt><tt class="py-number">2</tt><tt class="py-op">)</tt><tt class="py-op">,</tt> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt id="link-65" class="py-name" targets="Method Forensie.Forensie.GetBytes()=Forensie.Forensie-class.html#GetBytes"><a title="Forensie.Forensie.GetBytes" class="py-name" href="#" onclick="return doclink('link-65', 'GetBytes', 'link-65');">GetBytes</a></tt><tt class="py-op">(</tt><tt class="py-number">0</tt><tt class="py-op">,</tt> <tt class="py-name">width</tt><tt class="py-op">,</tt> <tt class="py-name">byteOffs</tt><tt class="py-op">)</tt><tt class="py-op">,</tt> <tt class="py-string">'-'</tt><tt class="py-op">*</tt><tt class="py-op">(</tt><tt class="py-name">offsetWidth</tt><tt class="py-op">+</tt><tt class="py-number">2</tt><tt class="py-op">)</tt><tt class="py-op">,</tt> <tt class="py-string">'-'</tt><tt class="py-op">*</tt><tt class="py-op">(</tt><tt class="py-name">width</tt><tt class="py-op">*</tt><tt class="py-number">3</tt><tt class="py-op">+</tt><tt class="py-number">1</tt><tt class="py-op">)</tt><tt class="py-op">,</tt> <tt class="py-string">'-'</tt><tt class="py-op">*</tt><tt class="py-op">(</tt><tt class="py-name">width</tt><tt class="py-op">+</tt><tt class="py-number">1</tt><tt class="py-op">)</tt><tt class="py-op">)</tt> </tt>
<a name="L517"></a><tt class="py-lineno">517</tt>  <tt class="py-line">                        <tt class="py-keyword">for</tt> <tt class="py-name">x</tt> <tt class="py-keyword">in</tt> <tt class="py-name">xrange</tt><tt class="py-op">(</tt><tt class="py-name">int</tt><tt class="py-op">(</tt><tt class="py-name">ceil</tt><tt class="py-op">(</tt><tt class="py-name">float</tt><tt class="py-op">(</tt><tt class="py-name">strLength</tt><tt class="py-op">)</tt><tt class="py-op">/</tt><tt class="py-name">width</tt><tt class="py-op">)</tt><tt class="py-op">)</tt><tt class="py-op">)</tt><tt class="py-op">:</tt> </tt>
<a name="L518"></a><tt class="py-lineno">518</tt>  <tt class="py-line">                                <tt class="py-name">offset</tt> <tt class="py-op">=</tt> <tt class="py-op">(</tt><tt class="py-string">'%x'</tt><tt class="py-op">%</tt><tt class="py-op">(</tt><tt class="py-name">x</tt><tt class="py-op">*</tt><tt class="py-name">width</tt><tt class="py-op">)</tt><tt class="py-op">)</tt><tt class="py-op">.</tt><tt class="py-name">rjust</tt><tt class="py-op">(</tt><tt class="py-name">offsetWidth</tt><tt class="py-op">,</tt> <tt class="py-string">'0'</tt><tt class="py-op">)</tt> </tt>
<a name="L519"></a><tt class="py-lineno">519</tt>  <tt class="py-line">                                <tt class="py-name">end</tt> <tt class="py-op">+=</tt> <tt class="py-string">' %s | %s | %s\n'</tt> <tt class="py-op">%</tt> <tt class="py-op">(</tt><tt class="py-name">offset</tt><tt class="py-op">,</tt> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt id="link-66" class="py-name"><a title="Forensie.Forensie.GetBytes" class="py-name" href="#" onclick="return doclink('link-66', 'GetBytes', 'link-65');">GetBytes</a></tt><tt class="py-op">(</tt><tt class="py-name">x</tt><tt class="py-op">,</tt> <tt class="py-name">width</tt><tt class="py-op">)</tt><tt class="py-op">,</tt> <tt class="py-name">tmp</tt><tt class="py-op">[</tt><tt class="py-name">x</tt><tt class="py-op">*</tt><tt class="py-name">width</tt><tt class="py-op">:</tt><tt class="py-op">(</tt><tt class="py-name">x</tt><tt class="py-op">+</tt><tt class="py-number">1</tt><tt class="py-op">)</tt><tt class="py-op">*</tt><tt class="py-name">width</tt><tt class="py-op">]</tt><tt class="py-op">)</tt> </tt>
<a name="L520"></a><tt class="py-lineno">520</tt>  <tt class="py-line">                        <tt class="py-keyword">return</tt> <tt class="py-name">end</tt> </tt>
<a name="L521"></a><tt class="py-lineno">521</tt>  <tt class="py-line">                <tt class="py-keyword">elif</tt> <tt class="py-name">width</tt> <tt class="py-op">==</tt> <tt class="py-name">float</tt><tt class="py-op">(</tt><tt class="py-string">'inf'</tt><tt class="py-op">)</tt><tt class="py-op">:</tt> </tt>
<a name="L522"></a><tt class="py-lineno">522</tt>  <tt class="py-line">                        <tt class="py-keyword">return</tt> <tt class="py-name">tmp</tt> </tt>
<a name="L523"></a><tt class="py-lineno">523</tt>  <tt class="py-line">                <tt class="py-keyword">else</tt><tt class="py-op">:</tt> </tt>
<a name="L524"></a><tt class="py-lineno">524</tt>  <tt class="py-line">                        <tt class="py-keyword">return</tt> <tt class="py-string">'\n'</tt><tt class="py-op">.</tt><tt class="py-name">join</tt><tt class="py-op">(</tt><tt class="py-name">findall</tt><tt class="py-op">(</tt><tt class="py-string">'.{1,%d}'</tt><tt class="py-op">%</tt><tt class="py-name">width</tt><tt class="py-op">,</tt> <tt class="py-name">tmp</tt><tt class="py-op">)</tt><tt class="py-op">)</tt> <tt class="py-comment"># Inserts a newline after width characters</tt> </tt>
</div><a name="L525"></a><tt class="py-lineno">525</tt>  <tt class="py-line">         </tt>
<a name="Forensie.CheckHex"></a><div id="Forensie.CheckHex-def"><a name="L526"></a><tt class="py-lineno">526</tt> <a class="py-toggle" href="#" id="Forensie.CheckHex-toggle" onclick="return toggle('Forensie.CheckHex');">-</a><tt class="py-line">        <tt class="py-keyword">def</tt> <a class="py-def-name" href="Forensie.Forensie-class.html#CheckHex">CheckHex</a><tt class="py-op">(</tt><tt class="py-param">self</tt><tt class="py-op">)</tt><tt class="py-op">:</tt> </tt>
</div><div id="Forensie.CheckHex-collapsed" style="display:none;" pad="+++" indent="++++++++++++"></div><div id="Forensie.CheckHex-expanded"><a name="L527"></a><tt class="py-lineno">527</tt>  <tt class="py-line">                <tt class="py-docstring">"""Determines if the input string has only valid hex characters. </tt> </tt>
<a name="L528"></a><tt class="py-lineno">528</tt>  <tt class="py-line"><tt class="py-docstring">                Usually this method is called from CheckBinary(), which calls this </tt> </tt>
<a name="L529"></a><tt class="py-lineno">529</tt>  <tt class="py-line"><tt class="py-docstring">                method when its test for binary characters fails.</tt> </tt>
<a name="L530"></a><tt class="py-lineno">530</tt>  <tt class="py-line"><tt class="py-docstring">                </tt> </tt>
<a name="L531"></a><tt class="py-lineno">531</tt>  <tt class="py-line"><tt class="py-docstring">                No return value. Instead self.format is set to 'hex' or 'bad'.</tt> </tt>
<a name="L532"></a><tt class="py-lineno">532</tt>  <tt class="py-line"><tt class="py-docstring">                """</tt> </tt>
<a name="L533"></a><tt class="py-lineno">533</tt>  <tt class="py-line">                <tt class="py-name">mbr</tt> <tt class="py-op">=</tt> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">inputStr</tt> <tt class="py-comment"># Make a copy of the MBR string</tt> </tt>
<a name="L534"></a><tt class="py-lineno">534</tt>  <tt class="py-line">                <tt class="py-keyword">for</tt> <tt class="py-name">ch</tt> <tt class="py-keyword">in</tt> <tt class="py-name">mbr</tt><tt class="py-op">:</tt> </tt>
<a name="L535"></a><tt class="py-lineno">535</tt>  <tt class="py-line">                        <tt class="py-keyword">if</tt> <tt class="py-name">ch</tt> <tt class="py-keyword">not</tt> <tt class="py-keyword">in</tt> <tt class="py-name">string</tt><tt class="py-op">.</tt><tt class="py-name">hexdigits</tt><tt class="py-op">:</tt> </tt>
<a name="L536"></a><tt class="py-lineno">536</tt>  <tt class="py-line">                                <tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">format</tt> <tt class="py-op">=</tt> <tt class="py-string">"bad: contains '%s'"</tt> <tt class="py-op">%</tt> <tt class="py-name">ch</tt> </tt>
<a name="L537"></a><tt class="py-lineno">537</tt>  <tt class="py-line">                                <tt class="py-keyword">return</tt> </tt>
<a name="L538"></a><tt class="py-lineno">538</tt>  <tt class="py-line">                <tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">format</tt> <tt class="py-op">=</tt> <tt class="py-string">'hex'</tt> </tt>
</div><a name="L539"></a><tt class="py-lineno">539</tt>  <tt class="py-line"> </tt>
<a name="Forensie.CheckBinary"></a><div id="Forensie.CheckBinary-def"><a name="L540"></a><tt class="py-lineno">540</tt> <a class="py-toggle" href="#" id="Forensie.CheckBinary-toggle" onclick="return toggle('Forensie.CheckBinary');">-</a><tt class="py-line">        <tt class="py-keyword">def</tt> <a class="py-def-name" href="Forensie.Forensie-class.html#CheckBinary">CheckBinary</a><tt class="py-op">(</tt><tt class="py-param">self</tt><tt class="py-op">)</tt><tt class="py-op">:</tt> </tt>
</div><div id="Forensie.CheckBinary-collapsed" style="display:none;" pad="+++" indent="++++++++++++"></div><div id="Forensie.CheckBinary-expanded"><a name="L541"></a><tt class="py-lineno">541</tt>  <tt class="py-line">                <tt class="py-docstring">"""Determines if the input string has only valid binary characters. If </tt> </tt>
<a name="L542"></a><tt class="py-lineno">542</tt>  <tt class="py-line"><tt class="py-docstring">                the test fails, this method calls CheckHex(). If the test passes, </tt> </tt>
<a name="L543"></a><tt class="py-lineno">543</tt>  <tt class="py-line"><tt class="py-docstring">                the text is sent to be converted to hex before further processing, </tt> </tt>
<a name="L544"></a><tt class="py-lineno">544</tt>  <tt class="py-line"><tt class="py-docstring">                which simplifies the writing of all other methods which process the </tt> </tt>
<a name="L545"></a><tt class="py-lineno">545</tt>  <tt class="py-line"><tt class="py-docstring">                input text. This method is the first before CheckHex() because it </tt> </tt>
<a name="L546"></a><tt class="py-lineno">546</tt>  <tt class="py-line"><tt class="py-docstring">                will fail earlier on non-binary character strings given that the </tt> </tt>
<a name="L547"></a><tt class="py-lineno">547</tt>  <tt class="py-line"><tt class="py-docstring">                set of valid characters = {'1', '0'}.</tt> </tt>
<a name="L548"></a><tt class="py-lineno">548</tt>  <tt class="py-line"><tt class="py-docstring">                </tt> </tt>
<a name="L549"></a><tt class="py-lineno">549</tt>  <tt class="py-line"><tt class="py-docstring">                No return value. Instead self.format is set to 'hex'.</tt> </tt>
<a name="L550"></a><tt class="py-lineno">550</tt>  <tt class="py-line"><tt class="py-docstring">                """</tt> </tt>
<a name="L551"></a><tt class="py-lineno">551</tt>  <tt class="py-line">                <tt class="py-name">mbr</tt> <tt class="py-op">=</tt> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">inputStr</tt> <tt class="py-comment"># Make a copy of the MBR string</tt> </tt>
<a name="L552"></a><tt class="py-lineno">552</tt>  <tt class="py-line">                <tt class="py-keyword">for</tt> <tt class="py-name">ch</tt> <tt class="py-keyword">in</tt> <tt class="py-name">mbr</tt><tt class="py-op">:</tt> </tt>
<a name="L553"></a><tt class="py-lineno">553</tt>  <tt class="py-line">                        <tt class="py-keyword">if</tt> <tt class="py-name">ch</tt> <tt class="py-keyword">not</tt> <tt class="py-keyword">in</tt> <tt class="py-string">'01'</tt><tt class="py-op">:</tt> </tt>
<a name="L554"></a><tt class="py-lineno">554</tt>  <tt class="py-line">                                <tt class="py-keyword">return</tt> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt id="link-67" class="py-name" targets="Method Forensie.Forensie.CheckHex()=Forensie.Forensie-class.html#CheckHex"><a title="Forensie.Forensie.CheckHex" class="py-name" href="#" onclick="return doclink('link-67', 'CheckHex', 'link-67');">CheckHex</a></tt><tt class="py-op">(</tt><tt class="py-op">)</tt> </tt>
<a name="L555"></a><tt class="py-lineno">555</tt>  <tt class="py-line">                <tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">inputStr</tt> <tt class="py-op">=</tt> <tt id="link-68" class="py-name" targets="Function Forensie.Bin2Hex()=Forensie-module.html#Bin2Hex"><a title="Forensie.Bin2Hex" class="py-name" href="#" onclick="return doclink('link-68', 'Bin2Hex', 'link-68');">Bin2Hex</a></tt><tt class="py-op">(</tt><tt class="py-name">mbr</tt><tt class="py-op">)</tt> <tt class="py-comment"># MBR string is in binary, convert to hex</tt> </tt>
<a name="L556"></a><tt class="py-lineno">556</tt>  <tt class="py-line">                <tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">format</tt> <tt class="py-op">=</tt> <tt class="py-string">'hex'</tt> </tt>
</div><a name="L557"></a><tt class="py-lineno">557</tt>  <tt class="py-line">                 </tt>
<a name="Forensie.FormatPartInfo"></a><div id="Forensie.FormatPartInfo-def"><a name="L558"></a><tt class="py-lineno">558</tt> <a class="py-toggle" href="#" id="Forensie.FormatPartInfo-toggle" onclick="return toggle('Forensie.FormatPartInfo');">-</a><tt class="py-line">        <tt class="py-keyword">def</tt> <a class="py-def-name" href="Forensie.Forensie-class.html#FormatPartInfo">FormatPartInfo</a><tt class="py-op">(</tt><tt class="py-param">self</tt><tt class="py-op">,</tt> <tt class="py-param">info</tt><tt class="py-op">)</tt><tt class="py-op">:</tt> </tt>
</div><div id="Forensie.FormatPartInfo-collapsed" style="display:none;" pad="+++" indent="++++++++++++"></div><div id="Forensie.FormatPartInfo-expanded"><a name="L559"></a><tt class="py-lineno">559</tt>  <tt class="py-line">                <tt class="py-docstring">"""Accepts a list (info) that has the information for the four </tt> </tt>
<a name="L560"></a><tt class="py-lineno">560</tt>  <tt class="py-line"><tt class="py-docstring">                partitions in the disk and formats them for being printed. Uses the </tt> </tt>
<a name="L561"></a><tt class="py-lineno">561</tt>  <tt class="py-line"><tt class="py-docstring">                sector counts to determine if any unallocated spaces exist between </tt> </tt>
<a name="L562"></a><tt class="py-lineno">562</tt>  <tt class="py-line"><tt class="py-docstring">                the partitions and inserts a notice at the top of the printed </tt> </tt>
<a name="L563"></a><tt class="py-lineno">563</tt>  <tt class="py-line"><tt class="py-docstring">                results if any are found.</tt> </tt>
<a name="L564"></a><tt class="py-lineno">564</tt>  <tt class="py-line"><tt class="py-docstring">                </tt> </tt>
<a name="L565"></a><tt class="py-lineno">565</tt>  <tt class="py-line"><tt class="py-docstring">                Returns the string.</tt> </tt>
<a name="L566"></a><tt class="py-lineno">566</tt>  <tt class="py-line"><tt class="py-docstring">                """</tt> </tt>
<a name="L567"></a><tt class="py-lineno">567</tt>  <tt class="py-line">                <tt class="py-name">cats</tt> <tt class="py-op">=</tt> <tt class="py-op">(</tt><tt class="py-string">'State'</tt><tt class="py-op">,</tt> <tt class="py-string">'CHS Address'</tt><tt class="py-op">,</tt> <tt class="py-string">'Partition Type'</tt><tt class="py-op">,</tt> <tt class="py-string">'End CHS Address'</tt><tt class="py-op">,</tt> <tt class="py-string">'LBA of First Sector'</tt><tt class="py-op">,</tt> <tt class="py-string">'Number of Blocks'</tt><tt class="py-op">)</tt> </tt>
<a name="L568"></a><tt class="py-lineno">568</tt>  <tt class="py-line">                <tt class="py-name">end</tt> <tt class="py-op">=</tt> <tt class="py-string">'Translation of MBR:\n\n'</tt> </tt>
<a name="L569"></a><tt class="py-lineno">569</tt>  <tt class="py-line">                 </tt>
<a name="L570"></a><tt class="py-lineno">570</tt>  <tt class="py-line">                <tt class="py-comment"># Look for empty spaces inbetween partitions</tt> </tt>
<a name="L571"></a><tt class="py-lineno">571</tt>  <tt class="py-line">                <tt class="py-name">lba</tt> <tt class="py-op">=</tt> <tt class="py-string">'LBA of First Sector'</tt> </tt>
<a name="L572"></a><tt class="py-lineno">572</tt>  <tt class="py-line">                <tt class="py-name">num</tt> <tt class="py-op">=</tt> <tt class="py-string">'Number of Blocks'</tt> </tt>
<a name="L573"></a><tt class="py-lineno">573</tt>  <tt class="py-line">                <tt class="py-name">ilen</tt> <tt class="py-op">=</tt> <tt class="py-name">len</tt><tt class="py-op">(</tt><tt class="py-name">info</tt><tt class="py-op">)</tt> </tt>
<a name="L574"></a><tt class="py-lineno">574</tt>  <tt class="py-line">                <tt class="py-name">info</tt><tt class="py-op">.</tt><tt class="py-name">append</tt><tt class="py-op">(</tt><tt class="py-op">{</tt><tt class="py-name">lba</tt><tt class="py-op">:</tt> <tt class="py-string">'0'</tt><tt class="py-op">,</tt> <tt class="py-name">num</tt><tt class="py-op">:</tt> <tt class="py-string">'1'</tt><tt class="py-op">}</tt><tt class="py-op">)</tt> </tt>
<a name="L575"></a><tt class="py-lineno">575</tt>  <tt class="py-line">                <tt class="py-keyword">for</tt> <tt class="py-name">n</tt> <tt class="py-keyword">in</tt> <tt class="py-name">xrange</tt><tt class="py-op">(</tt><tt class="py-name">ilen</tt><tt class="py-op">)</tt><tt class="py-op">:</tt> </tt>
<a name="L576"></a><tt class="py-lineno">576</tt>  <tt class="py-line">                        <tt class="py-name">diff</tt> <tt class="py-op">=</tt> <tt class="py-name">int</tt><tt class="py-op">(</tt><tt class="py-name">info</tt><tt class="py-op">[</tt><tt class="py-name">n</tt><tt class="py-op">]</tt><tt class="py-op">[</tt><tt class="py-name">lba</tt><tt class="py-op">]</tt><tt class="py-op">)</tt><tt class="py-op">-</tt><tt class="py-op">(</tt><tt class="py-name">int</tt><tt class="py-op">(</tt><tt class="py-name">info</tt><tt class="py-op">[</tt><tt class="py-name">n</tt><tt class="py-op">-</tt><tt class="py-number">1</tt><tt class="py-op">]</tt><tt class="py-op">[</tt><tt class="py-name">lba</tt><tt class="py-op">]</tt><tt class="py-op">)</tt><tt class="py-op">+</tt><tt class="py-name">int</tt><tt class="py-op">(</tt><tt class="py-name">info</tt><tt class="py-op">[</tt><tt class="py-name">n</tt><tt class="py-op">-</tt><tt class="py-number">1</tt><tt class="py-op">]</tt><tt class="py-op">[</tt><tt class="py-name">num</tt><tt class="py-op">]</tt><tt class="py-op">)</tt><tt class="py-op">)</tt> </tt>
<a name="L577"></a><tt class="py-lineno">577</tt>  <tt class="py-line">                        <tt class="py-keyword">if</tt> <tt class="py-name">diff</tt> <tt class="py-op">&gt;</tt> <tt class="py-number">0</tt><tt class="py-op">:</tt> </tt>
<a name="L578"></a><tt class="py-lineno">578</tt>  <tt class="py-line">                                <tt class="py-name">end</tt> <tt class="py-op">+=</tt> <tt class="py-string">'--NOTICE--\n%d sectors are unallocated in between partitions %d and %d\n\n'</tt> <tt class="py-op">%</tt> <tt class="py-op">(</tt><tt class="py-name">diff</tt><tt class="py-op">,</tt> <tt class="py-name">n</tt><tt class="py-op">,</tt> <tt class="py-name">n</tt><tt class="py-op">+</tt><tt class="py-number">1</tt><tt class="py-op">)</tt> </tt>
<a name="L579"></a><tt class="py-lineno">579</tt>  <tt class="py-line">                <tt class="py-name">info</tt><tt class="py-op">.</tt><tt class="py-name">pop</tt><tt class="py-op">(</tt><tt class="py-op">)</tt> </tt>
<a name="L580"></a><tt class="py-lineno">580</tt>  <tt class="py-line">                 </tt>
<a name="L581"></a><tt class="py-lineno">581</tt>  <tt class="py-line">                <tt class="py-keyword">for</tt> <tt class="py-name">n</tt> <tt class="py-keyword">in</tt> <tt class="py-name">xrange</tt><tt class="py-op">(</tt><tt class="py-name">len</tt><tt class="py-op">(</tt><tt class="py-name">info</tt><tt class="py-op">)</tt><tt class="py-op">)</tt><tt class="py-op">:</tt> <tt class="py-comment"># Loop through the 4 partitions</tt> </tt>
<a name="L582"></a><tt class="py-lineno">582</tt>  <tt class="py-line">                        <tt class="py-name">end</tt> <tt class="py-op">+=</tt> <tt class="py-string">"Partition %d\n\n"</tt> <tt class="py-op">%</tt> <tt class="py-op">(</tt><tt class="py-name">n</tt><tt class="py-op">+</tt><tt class="py-number">1</tt><tt class="py-op">)</tt> </tt>
<a name="L583"></a><tt class="py-lineno">583</tt>  <tt class="py-line">                        <tt class="py-keyword">for</tt> <tt class="py-name">cat</tt> <tt class="py-keyword">in</tt> <tt class="py-name">cats</tt><tt class="py-op">:</tt> </tt>
<a name="L584"></a><tt class="py-lineno">584</tt>  <tt class="py-line">                                <tt class="py-name">end</tt> <tt class="py-op">+=</tt> <tt class="py-string">"%s: %s\n"</tt> <tt class="py-op">%</tt> <tt class="py-op">(</tt><tt class="py-name">cat</tt><tt class="py-op">,</tt> <tt class="py-name">info</tt><tt class="py-op">[</tt><tt class="py-name">n</tt><tt class="py-op">]</tt><tt class="py-op">[</tt><tt class="py-name">cat</tt><tt class="py-op">]</tt><tt class="py-op">)</tt> </tt>
<a name="L585"></a><tt class="py-lineno">585</tt>  <tt class="py-line">                        <tt class="py-name">end</tt> <tt class="py-op">+=</tt> <tt class="py-string">"\n"</tt> </tt>
<a name="L586"></a><tt class="py-lineno">586</tt>  <tt class="py-line">                <tt class="py-keyword">return</tt> <tt class="py-name">end</tt> </tt>
</div><a name="L587"></a><tt class="py-lineno">587</tt>  <tt class="py-line">                 </tt>
<a name="Forensie.GetCommandDescriptions"></a><div id="Forensie.GetCommandDescriptions-def"><a name="L588"></a><tt class="py-lineno">588</tt> <a class="py-toggle" href="#" id="Forensie.GetCommandDescriptions-toggle" onclick="return toggle('Forensie.GetCommandDescriptions');">-</a><tt class="py-line">        <tt class="py-keyword">def</tt> <a class="py-def-name" href="Forensie.Forensie-class.html#GetCommandDescriptions">GetCommandDescriptions</a><tt class="py-op">(</tt><tt class="py-param">self</tt><tt class="py-op">)</tt><tt class="py-op">:</tt> </tt>
</div><div id="Forensie.GetCommandDescriptions-collapsed" style="display:none;" pad="+++" indent="++++++++++++"></div><div id="Forensie.GetCommandDescriptions-expanded"><a name="L589"></a><tt class="py-lineno">589</tt>  <tt class="py-line">                <tt class="py-docstring">"""Returns a string with all supported commands in the format: \n\ncommand: description\ncommand: description\n...</tt> </tt>
<a name="L590"></a><tt class="py-lineno">590</tt>  <tt class="py-line"><tt class="py-docstring">                """</tt> </tt>
<a name="L591"></a><tt class="py-lineno">591</tt>  <tt class="py-line">                <tt class="py-name">end</tt> <tt class="py-op">=</tt> <tt class="py-string">''</tt> </tt>
<a name="L592"></a><tt class="py-lineno">592</tt>  <tt class="py-line">                <tt class="py-keyword">for</tt> <tt class="py-name">k</tt> <tt class="py-keyword">in</tt> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">supported_commands</tt><tt class="py-op">:</tt> </tt>
<a name="L593"></a><tt class="py-lineno">593</tt>  <tt class="py-line">                        <tt class="py-name">end</tt> <tt class="py-op">+=</tt> <tt class="py-string">'\n%s: %s'</tt> <tt class="py-op">%</tt> <tt class="py-op">(</tt><tt class="py-name">k</tt><tt class="py-op">,</tt> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">command_descriptions</tt><tt class="py-op">[</tt><tt class="py-name">k</tt><tt class="py-op">]</tt><tt class="py-op">)</tt> </tt>
<a name="L594"></a><tt class="py-lineno">594</tt>  <tt class="py-line">                <tt class="py-keyword">return</tt> <tt class="py-name">end</tt> </tt>
</div></div><a name="L595"></a><tt class="py-lineno">595</tt>  <tt class="py-line"> </tt>
<a name="StrFlatten"></a><div id="StrFlatten-def"><a name="L596"></a><tt class="py-lineno">596</tt> <a class="py-toggle" href="#" id="StrFlatten-toggle" onclick="return toggle('StrFlatten');">-</a><tt class="py-line"><tt class="py-keyword">def</tt> <a class="py-def-name" href="Forensie-module.html#StrFlatten">StrFlatten</a><tt class="py-op">(</tt><tt class="py-param">mylist</tt><tt class="py-op">)</tt><tt class="py-op">:</tt> </tt>
</div><div id="StrFlatten-collapsed" style="display:none;" pad="+++" indent="++++"></div><div id="StrFlatten-expanded"><a name="L597"></a><tt class="py-lineno">597</tt>  <tt class="py-line">        <tt class="py-docstring">"""Takes a list of strings, mylist, and makes one string from it. Returns </tt> </tt>
<a name="L598"></a><tt class="py-lineno">598</tt>  <tt class="py-line"><tt class="py-docstring">        the string.</tt> </tt>
<a name="L599"></a><tt class="py-lineno">599</tt>  <tt class="py-line"><tt class="py-docstring">        """</tt> </tt>
<a name="L600"></a><tt class="py-lineno">600</tt>  <tt class="py-line">        <tt class="py-keyword">if</tt> <tt class="py-name">mylist</tt> <tt class="py-op">==</tt> <tt class="py-op">[</tt><tt class="py-op">]</tt><tt class="py-op">:</tt> <tt class="py-keyword">raise</tt> <tt class="py-name">IndexError</tt> </tt>
<a name="L601"></a><tt class="py-lineno">601</tt>  <tt class="py-line">        <tt class="py-name">s</tt> <tt class="py-op">=</tt> <tt class="py-string">''</tt> </tt>
<a name="L602"></a><tt class="py-lineno">602</tt>  <tt class="py-line">        <tt class="py-keyword">for</tt> <tt class="py-name">x</tt> <tt class="py-keyword">in</tt> <tt class="py-name">mylist</tt><tt class="py-op">:</tt> </tt>
<a name="L603"></a><tt class="py-lineno">603</tt>  <tt class="py-line">                <tt class="py-name">s</tt> <tt class="py-op">+=</tt> <tt class="py-string">'%s'</tt> <tt class="py-op">%</tt> <tt class="py-name">x</tt> </tt>
<a name="L604"></a><tt class="py-lineno">604</tt>  <tt class="py-line">        <tt class="py-keyword">return</tt> <tt class="py-name">s</tt> </tt>
</div><a name="L605"></a><tt class="py-lineno">605</tt>  <tt class="py-line">         </tt>
<a name="Bin2Hex"></a><div id="Bin2Hex-def"><a name="L606"></a><tt class="py-lineno">606</tt> <a class="py-toggle" href="#" id="Bin2Hex-toggle" onclick="return toggle('Bin2Hex');">-</a><tt class="py-line"><tt class="py-keyword">def</tt> <a class="py-def-name" href="Forensie-module.html#Bin2Hex">Bin2Hex</a><tt class="py-op">(</tt><tt class="py-param">numstr</tt><tt class="py-op">)</tt><tt class="py-op">:</tt> </tt>
</div><div id="Bin2Hex-collapsed" style="display:none;" pad="+++" indent="++++"></div><div id="Bin2Hex-expanded"><a name="L607"></a><tt class="py-lineno">607</tt>  <tt class="py-line">        <tt class="py-docstring">"""Converts the given binary numstr (string) to a hex string. Returns the </tt> </tt>
<a name="L608"></a><tt class="py-lineno">608</tt>  <tt class="py-line"><tt class="py-docstring">        string.</tt> </tt>
<a name="L609"></a><tt class="py-lineno">609</tt>  <tt class="py-line"><tt class="py-docstring">        """</tt> </tt>
<a name="L610"></a><tt class="py-lineno">610</tt>  <tt class="py-line">        <tt class="py-name">result</tt> <tt class="py-op">=</tt> <tt class="py-string">''</tt> </tt>
<a name="L611"></a><tt class="py-lineno">611</tt>  <tt class="py-line">        <tt class="py-keyword">while</tt> <tt class="py-name">len</tt><tt class="py-op">(</tt><tt class="py-name">numstr</tt><tt class="py-op">)</tt><tt class="py-op">:</tt> </tt>
<a name="L612"></a><tt class="py-lineno">612</tt>  <tt class="py-line">                <tt class="py-name">bstr</tt> <tt class="py-op">=</tt> <tt class="py-name">numstr</tt><tt class="py-op">[</tt><tt class="py-op">:</tt><tt class="py-number">8</tt><tt class="py-op">]</tt> </tt>
<a name="L613"></a><tt class="py-lineno">613</tt>  <tt class="py-line">                <tt class="py-name">numstr</tt> <tt class="py-op">=</tt> <tt class="py-name">numstr</tt><tt class="py-op">[</tt><tt class="py-number">8</tt><tt class="py-op">:</tt><tt class="py-op">]</tt> </tt>
<a name="L614"></a><tt class="py-lineno">614</tt>  <tt class="py-line">                <tt class="py-name">tmpval</tt> <tt class="py-op">=</tt> <tt class="py-number">0</tt> </tt>
<a name="L615"></a><tt class="py-lineno">615</tt>  <tt class="py-line">                <tt class="py-keyword">for</tt> <tt class="py-name">x</tt> <tt class="py-keyword">in</tt> <tt class="py-name">bstr</tt><tt class="py-op">:</tt> </tt>
<a name="L616"></a><tt class="py-lineno">616</tt>  <tt class="py-line">                        <tt class="py-name">tmpval</tt> <tt class="py-op">*=</tt> <tt class="py-number">2</tt> </tt>
<a name="L617"></a><tt class="py-lineno">617</tt>  <tt class="py-line">                        <tt class="py-name">tmpval</tt> <tt class="py-op">+=</tt> <tt class="py-name">int</tt><tt class="py-op">(</tt><tt class="py-name">x</tt><tt class="py-op">)</tt> </tt>
<a name="L618"></a><tt class="py-lineno">618</tt>  <tt class="py-line">                <tt class="py-name">result</tt> <tt class="py-op">+=</tt> <tt class="py-string">'%x'</tt> <tt class="py-op">%</tt> <tt class="py-name">tmpval</tt> </tt>
<a name="L619"></a><tt class="py-lineno">619</tt>  <tt class="py-line">        <tt class="py-keyword">return</tt> <tt class="py-name">result</tt> </tt>
</div><a name="L620"></a><tt class="py-lineno">620</tt>  <tt class="py-line"> </tt>
<a name="Hex2Dec"></a><div id="Hex2Dec-def"><a name="L621"></a><tt class="py-lineno">621</tt> <a class="py-toggle" href="#" id="Hex2Dec-toggle" onclick="return toggle('Hex2Dec');">-</a><tt class="py-line"><tt class="py-keyword">def</tt> <a class="py-def-name" href="Forensie-module.html#Hex2Dec">Hex2Dec</a><tt class="py-op">(</tt><tt class="py-param">numstr</tt><tt class="py-op">,</tt> <tt class="py-param">endian</tt><tt class="py-op">=</tt><tt class="py-string">'little'</tt><tt class="py-op">)</tt><tt class="py-op">:</tt> </tt>
</div><div id="Hex2Dec-collapsed" style="display:none;" pad="+++" indent="++++"></div><div id="Hex2Dec-expanded"><a name="L622"></a><tt class="py-lineno">622</tt>  <tt class="py-line">        <tt class="py-docstring">"""Takes a hex number string and converts it to a decimal number. Returns </tt> </tt>
<a name="L623"></a><tt class="py-lineno">623</tt>  <tt class="py-line"><tt class="py-docstring">        the number.</tt> </tt>
<a name="L624"></a><tt class="py-lineno">624</tt>  <tt class="py-line"><tt class="py-docstring">        """</tt> </tt>
<a name="L625"></a><tt class="py-lineno">625</tt>  <tt class="py-line">        <tt class="py-name">count</tt><tt class="py-op">,</tt> <tt class="py-name">num</tt> <tt class="py-op">=</tt> <tt class="py-number">0</tt><tt class="py-op">,</tt> <tt class="py-number">0</tt> </tt>
<a name="L626"></a><tt class="py-lineno">626</tt>  <tt class="py-line">         </tt>
<a name="L627"></a><tt class="py-lineno">627</tt>  <tt class="py-line">        <tt class="py-comment"># Convert Little Endian number before processing</tt> </tt>
<a name="L628"></a><tt class="py-lineno">628</tt>  <tt class="py-line">        <tt class="py-keyword">if</tt> <tt class="py-name">endian</tt> <tt class="py-op">==</tt> <tt class="py-string">'little'</tt><tt class="py-op">:</tt> </tt>
<a name="L629"></a><tt class="py-lineno">629</tt>  <tt class="py-line">                <tt class="py-name">newstr</tt> <tt class="py-op">=</tt> <tt class="py-string">''</tt> </tt>
<a name="L630"></a><tt class="py-lineno">630</tt>  <tt class="py-line">                <tt class="py-keyword">while</tt> <tt class="py-name">len</tt><tt class="py-op">(</tt><tt class="py-name">numstr</tt><tt class="py-op">)</tt><tt class="py-op">:</tt> </tt>
<a name="L631"></a><tt class="py-lineno">631</tt>  <tt class="py-line">                        <tt class="py-name">newstr</tt> <tt class="py-op">=</tt> <tt class="py-name">numstr</tt><tt class="py-op">[</tt><tt class="py-op">:</tt><tt class="py-number">2</tt><tt class="py-op">]</tt> <tt class="py-op">+</tt> <tt class="py-name">newstr</tt> </tt>
<a name="L632"></a><tt class="py-lineno">632</tt>  <tt class="py-line">                        <tt class="py-name">numstr</tt> <tt class="py-op">=</tt> <tt class="py-name">numstr</tt><tt class="py-op">[</tt><tt class="py-number">2</tt><tt class="py-op">:</tt><tt class="py-op">]</tt> </tt>
<a name="L633"></a><tt class="py-lineno">633</tt>  <tt class="py-line">                <tt class="py-name">numstr</tt> <tt class="py-op">=</tt> <tt class="py-name">newstr</tt> </tt>
<a name="L634"></a><tt class="py-lineno">634</tt>  <tt class="py-line">                <tt class="py-comment">#print "Converted Little Endian number to %s" % numstr</tt> </tt>
<a name="L635"></a><tt class="py-lineno">635</tt>  <tt class="py-line">         </tt>
<a name="L636"></a><tt class="py-lineno">636</tt>  <tt class="py-line">        <tt class="py-keyword">for</tt> <tt class="py-name">n</tt> <tt class="py-keyword">in</tt> <tt class="py-name">numstr</tt><tt class="py-op">[</tt><tt class="py-op">:</tt><tt class="py-op">:</tt><tt class="py-op">-</tt><tt class="py-number">1</tt><tt class="py-op">]</tt><tt class="py-op">:</tt> </tt>
<a name="L637"></a><tt class="py-lineno">637</tt>  <tt class="py-line">                <tt class="py-name">num</tt> <tt class="py-op">+=</tt> <tt class="py-name">string</tt><tt class="py-op">.</tt><tt class="py-name">hexdigits</tt><tt class="py-op">.</tt><tt class="py-name">index</tt><tt class="py-op">(</tt><tt class="py-name">n</tt><tt class="py-op">.</tt><tt class="py-name">lower</tt><tt class="py-op">(</tt><tt class="py-op">)</tt><tt class="py-op">)</tt> <tt class="py-op">*</tt> <tt class="py-number">16</tt><tt class="py-op">**</tt><tt class="py-name">count</tt> </tt>
<a name="L638"></a><tt class="py-lineno">638</tt>  <tt class="py-line">                <tt class="py-name">count</tt> <tt class="py-op">+=</tt> <tt class="py-number">1</tt> </tt>
<a name="L639"></a><tt class="py-lineno">639</tt>  <tt class="py-line">        <tt class="py-keyword">return</tt> <tt class="py-name">num</tt> </tt>
</div><a name="L640"></a><tt class="py-lineno">640</tt>  <tt class="py-line"> </tt>
<a name="ChopHexStr"></a><div id="ChopHexStr-def"><a name="L641"></a><tt class="py-lineno">641</tt> <a class="py-toggle" href="#" id="ChopHexStr-toggle" onclick="return toggle('ChopHexStr');">-</a><tt class="py-line"><tt class="py-keyword">def</tt> <a class="py-def-name" href="Forensie-module.html#ChopHexStr">ChopHexStr</a><tt class="py-op">(</tt><tt class="py-param">hexstr</tt><tt class="py-op">)</tt><tt class="py-op">:</tt> </tt>
</div><div id="ChopHexStr-collapsed" style="display:none;" pad="+++" indent="++++"></div><div id="ChopHexStr-expanded"><a name="L642"></a><tt class="py-lineno">642</tt>  <tt class="py-line">        <tt class="py-docstring">"""Takes a hex string and divides it into strings of length 2 (each </tt> </tt>
<a name="L643"></a><tt class="py-lineno">643</tt>  <tt class="py-line"><tt class="py-docstring">        representing a byte) and places them in a list. Returns the list.</tt> </tt>
<a name="L644"></a><tt class="py-lineno">644</tt>  <tt class="py-line"><tt class="py-docstring">        """</tt> </tt>
<a name="L645"></a><tt class="py-lineno">645</tt>  <tt class="py-line">        <tt class="py-name">tmp</tt> <tt class="py-op">=</tt> <tt class="py-name">hexstr</tt> <tt class="py-comment"># Make a copy of the input string</tt> </tt>
<a name="L646"></a><tt class="py-lineno">646</tt>  <tt class="py-line">        <tt class="py-name">bytes</tt> <tt class="py-op">=</tt> <tt class="py-op">[</tt><tt class="py-op">]</tt> </tt>
<a name="L647"></a><tt class="py-lineno">647</tt>  <tt class="py-line">        <tt class="py-comment"># Break hexstr into bytes and put each byte in the 'bytes' list</tt> </tt>
<a name="L648"></a><tt class="py-lineno">648</tt>  <tt class="py-line">        <tt class="py-keyword">while</tt> <tt class="py-name">tmp</tt><tt class="py-op">:</tt> </tt>
<a name="L649"></a><tt class="py-lineno">649</tt>  <tt class="py-line">                <tt class="py-name">bytes</tt> <tt class="py-op">+=</tt> <tt class="py-op">[</tt><tt class="py-op">(</tt><tt class="py-name">tmp</tt><tt class="py-op">[</tt><tt class="py-op">:</tt><tt class="py-number">2</tt><tt class="py-op">]</tt><tt class="py-op">)</tt><tt class="py-op">]</tt> </tt>
<a name="L650"></a><tt class="py-lineno">650</tt>  <tt class="py-line">                <tt class="py-name">tmp</tt> <tt class="py-op">=</tt> <tt class="py-name">tmp</tt><tt class="py-op">[</tt><tt class="py-number">2</tt><tt class="py-op">:</tt><tt class="py-op">]</tt> </tt>
<a name="L651"></a><tt class="py-lineno">651</tt>  <tt class="py-line">        <tt class="py-keyword">return</tt> <tt class="py-name">bytes</tt> </tt>
</div><a name="L652"></a><tt class="py-lineno">652</tt>  <tt class="py-line">         </tt>
<a name="Hex2BinStr"></a><div id="Hex2BinStr-def"><a name="L653"></a><tt class="py-lineno">653</tt> <a class="py-toggle" href="#" id="Hex2BinStr-toggle" onclick="return toggle('Hex2BinStr');">-</a><tt class="py-line"><tt class="py-keyword">def</tt> <a class="py-def-name" href="Forensie-module.html#Hex2BinStr">Hex2BinStr</a><tt class="py-op">(</tt><tt class="py-param">hexstr</tt><tt class="py-op">,</tt> <tt class="py-param">endian</tt><tt class="py-op">=</tt><tt class="py-string">'little'</tt><tt class="py-op">)</tt><tt class="py-op">:</tt> </tt>
</div><div id="Hex2BinStr-collapsed" style="display:none;" pad="+++" indent="++++"></div><div id="Hex2BinStr-expanded"><a name="L654"></a><tt class="py-lineno">654</tt>  <tt class="py-line">        <tt class="py-docstring">"""</tt> </tt>
<a name="L655"></a><tt class="py-lineno">655</tt>  <tt class="py-line"><tt class="py-docstring">        Accepts a hex text string and translates it into a binary text string. </tt> </tt>
<a name="L656"></a><tt class="py-lineno">656</tt>  <tt class="py-line"><tt class="py-docstring">        Returns the binary text string.</tt> </tt>
<a name="L657"></a><tt class="py-lineno">657</tt>  <tt class="py-line"><tt class="py-docstring">        """</tt> </tt>
<a name="L658"></a><tt class="py-lineno">658</tt>  <tt class="py-line">        <tt class="py-name">binstr</tt> <tt class="py-op">=</tt> <tt class="py-string">''</tt> </tt>
<a name="L659"></a><tt class="py-lineno">659</tt>  <tt class="py-line">        <tt class="py-name">dir</tt> <tt class="py-op">=</tt> <tt class="py-number">1</tt> </tt>
<a name="L660"></a><tt class="py-lineno">660</tt>  <tt class="py-line">        <tt class="py-comment">#if endian == 'little':</tt> </tt>
<a name="L661"></a><tt class="py-lineno">661</tt>  <tt class="py-line">        <tt class="py-comment">#       dir = -1</tt> </tt>
<a name="L662"></a><tt class="py-lineno">662</tt>  <tt class="py-line">        <tt class="py-keyword">for</tt> <tt class="py-name">ch</tt> <tt class="py-keyword">in</tt> <tt class="py-name">hexstr</tt><tt class="py-op">[</tt><tt class="py-op">:</tt><tt class="py-op">:</tt><tt class="py-name">dir</tt><tt class="py-op">]</tt><tt class="py-op">:</tt> </tt>
<a name="L663"></a><tt class="py-lineno">663</tt>  <tt class="py-line">                <tt class="py-name">binstr</tt> <tt class="py-op">+=</tt> <tt id="link-69" class="py-name"><a title="Forensie.HEXBIN_TRANS" class="py-name" href="#" onclick="return doclink('link-69', 'HEXBIN_TRANS', 'link-1');">HEXBIN_TRANS</a></tt><tt class="py-op">[</tt><tt class="py-name">ch</tt><tt class="py-op">]</tt> </tt>
<a name="L664"></a><tt class="py-lineno">664</tt>  <tt class="py-line">        <tt class="py-keyword">return</tt> <tt class="py-name">binstr</tt> </tt>
</div><a name="L665"></a><tt class="py-lineno">665</tt>  <tt class="py-line"> </tt>
<a name="L666"></a><tt class="py-lineno">666</tt>  <tt class="py-line"><tt class="py-keyword">if</tt> <tt class="py-name">__name__</tt> <tt class="py-op">==</tt> <tt class="py-string">'__main__'</tt><tt class="py-op">:</tt> </tt>
<a name="L667"></a><tt class="py-lineno">667</tt>  <tt class="py-line">        <tt class="py-name">mbr</tt> <tt class="py-op">=</tt> <tt class="py-string">'33 C0 8E D0 BC 00 7C FB 50 07 50 1F FC BE 1B 7C BF 1B 06 50 57 B9 E5 01 F3 A4 CB BD BE 07 B1 04 38 6E 00 7C 09 75 13 83 C5 10 E2 F4 CD 18 8B F5 83 C6 10 49 74 19 38 2C 74 F6 A0 B5 07 B4 07 8B F0 AC 3C 00 74 FC BB 07 00 B4 0E CD 10 EB F2 88 4E 10 E8 46 00 73 2A FE 46 10 80 7E 04 0B 74 0B 80 7E 04 0C 74 05 A0 B6 07 75 D2 80 46 02 06 83 46 08 06 83 56 0A 00 E8 21 00 73 05 A0 B6 07 EB BC 81 3E FE 7D 55 AA 74 0B 80 7E 10 00 74 C8 A0 B7 07 EB A9 8B FC 1E 57 8B F5 CB BF 05 00 8A 56 00 B4 08 CD 13 72 23 8A C1 24 3F 98 8A DE 8A FC 43 F7 E3 8B D1 86 D6 B1 06 D2 EE 42 F7 E2 39 56 0A 77 23 72 05 39 46 08 73 1C B8 01 02 BB 00 7C 8B 4E 02 8B 56 00 CD 13 73 51 4F 74 4E 32 E4 8A 56 00 CD 13 EB E4 8A 56 00 60 BB AA 55 B4 41 CD 13 72 36 81 FB 55 AA 75 30 F6 C1 01 74 2B 61 60 6A 00 6A 00 FF 76 0A FF 76 08 6A 00 68 00 7C 6A 01 6A 10 B4 42 8B F4 CD 13 61 61 73 0E 4F 74 0B 32 E4 8A 56 00 CD 13 EB D6 61 F9 C3 49 6E 76 61 6C 69 64 20 70 61 72 74 69 74 69 6F 6E 20 74 61 62 6C 65 00 45 72 72 6F 72 20 6C 6F 61 64 69 6E 67 20 6F 70 65 72 61 74 69 6E 67 20 73 79 73 74 65 6D 00 4D 69 73 73 69 6E 67 20 6F 70 65 72 61 74 69 6E 67 20 73 79 73 74 65 6D 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2C 44 63 8F D5 32 82 00 00 00 01 01 00 DE FE 3F 08 3F 00 00 00 8A 34 02 00 80 00 01 09 07 FE FF FF C9 34 02 00 B0 1A 18 1D 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 AA'</tt> </tt>
<a name="L668"></a><tt class="py-lineno">668</tt>  <tt class="py-line">        <tt class="py-name">foren</tt> <tt class="py-op">=</tt> <tt id="link-70" class="py-name" targets="Module Forensie=Forensie-module.html,Class Forensie.Forensie=Forensie.Forensie-class.html"><a title="Forensie
Forensie.Forensie" class="py-name" href="#" onclick="return doclink('link-70', 'Forensie', 'link-70');">Forensie</a></tt><tt class="py-op">(</tt><tt class="py-name">mbr</tt><tt class="py-op">)</tt> </tt>
<a name="L669"></a><tt class="py-lineno">669</tt>  <tt class="py-line">        <tt class="py-keyword">print</tt> <tt class="py-name">foren</tt><tt class="py-op">.</tt><tt id="link-71" class="py-name"><a title="Forensie.Forensie.ProcessInput" class="py-name" href="#" onclick="return doclink('link-71', 'ProcessInput', 'link-7');">ProcessInput</a></tt><tt class="py-op">(</tt><tt class="py-op">)</tt> </tt>
<a name="L670"></a><tt class="py-lineno">670</tt>  <tt class="py-line"> </tt><script type="text/javascript">
<!--
expandto(location.href);
// -->
</script>
</pre>
<br />
<!-- ==================== NAVIGATION BAR ==================== -->
<table class="navbar" border="0" width="100%" cellpadding="0"
       bgcolor="#a0c0ff" cellspacing="0">
  <tr valign="middle">

  <!-- Tree link -->
      <th>&nbsp;&nbsp;&nbsp;<a
        href="module-tree.html">Trees</a>&nbsp;&nbsp;&nbsp;</th>

  <!-- Index link -->
      <th>&nbsp;&nbsp;&nbsp;<a
        href="identifier-index.html">Indices</a>&nbsp;&nbsp;&nbsp;</th>

  <!-- Help link -->
      <th>&nbsp;&nbsp;&nbsp;<a
        href="help.html">Help</a>&nbsp;&nbsp;&nbsp;</th>

  <!-- Project homepage -->
      <th class="navbar" align="right" width="100%">
        <table border="0" cellpadding="0" cellspacing="0">
          <tr><th class="navbar" align="center"
            ><a class="navbar" target="_top" href="http://code.google.com/p/forensie/">Forensie</a></th>
          </tr></table></th>
  </tr>
</table>
<table border="0" cellpadding="0" cellspacing="0" width="100%%">
  <tr>
    <td align="left" class="footer">
    Generated by Epydoc 3.0.1 on Tue May 04 17:43:52 2010
    </td>
    <td align="right" class="footer">
      <a target="mainFrame" href="http://epydoc.sourceforge.net"
        >http://epydoc.sourceforge.net</a>
    </td>
  </tr>
</table>

<script type="text/javascript">
  <!--
  // Private objects are initially displayed (because if
  // javascript is turned off then we want them to be
  // visible); but by default, we want to hide them.  So hide
  // them unless we have a cookie that says to show them.
  checkCookie();
  // -->
</script>
</body>
</html>
